parse.y revision 171172
1/* $OpenBSD: parse.y,v 1.517 2007/02/03 23:26:40 dhartmei Exp $ */ 2 3/* 4 * Copyright (c) 2001 Markus Friedl. All rights reserved. 5 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29%{ 30#include <sys/cdefs.h> 31__FBSDID("$FreeBSD: head/contrib/pf/pfctl/parse.y 171172 2007-07-03 12:30:03Z mlaier $"); 32 33#include <sys/types.h> 34#include <sys/socket.h> 35#include <net/if.h> 36#include <netinet/in.h> 37#include <netinet/in_systm.h> 38#include <netinet/ip.h> 39#include <netinet/ip_icmp.h> 40#include <netinet/icmp6.h> 41#include <net/pfvar.h> 42#include <arpa/inet.h> 43#include <altq/altq.h> 44#include <altq/altq_cbq.h> 45#include <altq/altq_priq.h> 46#include <altq/altq_hfsc.h> 47 48#include <stdio.h> 49#include <stdlib.h> 50#include <netdb.h> 51#include <stdarg.h> 52#include <errno.h> 53#include <string.h> 54#include <ctype.h> 55#include <math.h> 56#include <err.h> 57#include <limits.h> 58#include <pwd.h> 59#include <grp.h> 60#include <md5.h> 61 62#include "pfctl_parser.h" 63#include "pfctl.h" 64 65#ifdef __FreeBSD__ 66#define HTONL(x) (x) = htonl((__uint32_t)(x)) 67#endif 68 69static struct pfctl *pf = NULL; 70static FILE *fin = NULL; 71static int debug = 0; 72static int lineno = 1; 73static int errors = 0; 74static int rulestate = 0; 75static u_int16_t returnicmpdefault = 76 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 77static u_int16_t returnicmp6default = 78 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 79static int blockpolicy = PFRULE_DROP; 80static int require_order = 1; 81static int default_statelock; 82 83enum { 84 PFCTL_STATE_NONE, 85 PFCTL_STATE_OPTION, 86 PFCTL_STATE_SCRUB, 87 PFCTL_STATE_QUEUE, 88 PFCTL_STATE_NAT, 89 PFCTL_STATE_FILTER 90}; 91 92struct node_proto { 93 u_int8_t proto; 94 struct node_proto *next; 95 struct node_proto *tail; 96}; 97 98struct node_port { 99 u_int16_t port[2]; 100 u_int8_t op; 101 struct node_port *next; 102 struct node_port *tail; 103}; 104 105struct node_uid { 106 uid_t uid[2]; 107 u_int8_t op; 108 struct node_uid *next; 109 struct node_uid *tail; 110}; 111 112struct node_gid { 113 gid_t gid[2]; 114 u_int8_t op; 115 struct node_gid *next; 116 struct node_gid *tail; 117}; 118 119struct node_icmp { 120 u_int8_t code; 121 u_int8_t type; 122 u_int8_t proto; 123 struct node_icmp *next; 124 struct node_icmp *tail; 125}; 126 127enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 128 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 129 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 130 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 131 PF_STATE_OPT_TIMEOUT }; 132 133enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 134 135struct node_state_opt { 136 int type; 137 union { 138 u_int32_t max_states; 139 u_int32_t max_src_states; 140 u_int32_t max_src_conn; 141 struct { 142 u_int32_t limit; 143 u_int32_t seconds; 144 } max_src_conn_rate; 145 struct { 146 u_int8_t flush; 147 char tblname[PF_TABLE_NAME_SIZE]; 148 } overload; 149 u_int32_t max_src_nodes; 150 u_int8_t src_track; 151 u_int32_t statelock; 152 struct { 153 int number; 154 u_int32_t seconds; 155 } timeout; 156 } data; 157 struct node_state_opt *next; 158 struct node_state_opt *tail; 159}; 160 161struct peer { 162 struct node_host *host; 163 struct node_port *port; 164}; 165 166struct node_queue { 167 char queue[PF_QNAME_SIZE]; 168 char parent[PF_QNAME_SIZE]; 169 char ifname[IFNAMSIZ]; 170 int scheduler; 171 struct node_queue *next; 172 struct node_queue *tail; 173} *queues = NULL; 174 175struct node_qassign { 176 char *qname; 177 char *pqname; 178}; 179 180struct filter_opts { 181 int marker; 182#define FOM_FLAGS 0x01 183#define FOM_ICMP 0x02 184#define FOM_TOS 0x04 185#define FOM_KEEP 0x08 186#define FOM_SRCTRACK 0x10 187 struct node_uid *uid; 188 struct node_gid *gid; 189 struct { 190 u_int8_t b1; 191 u_int8_t b2; 192 u_int16_t w; 193 u_int16_t w2; 194 } flags; 195 struct node_icmp *icmpspec; 196 u_int32_t tos; 197 u_int32_t prob; 198 struct { 199 int action; 200 struct node_state_opt *options; 201 } keep; 202 int fragment; 203 int allowopts; 204 char *label; 205 struct node_qassign queues; 206 char *tag; 207 char *match_tag; 208 u_int8_t match_tag_not; 209 int rtableid; 210} filter_opts; 211 212struct antispoof_opts { 213 char *label; 214 int rtableid; 215} antispoof_opts; 216 217struct scrub_opts { 218 int marker; 219#define SOM_MINTTL 0x01 220#define SOM_MAXMSS 0x02 221#define SOM_FRAGCACHE 0x04 222 int nodf; 223 int minttl; 224 int maxmss; 225 int fragcache; 226 int randomid; 227 int reassemble_tcp; 228 int rtableid; 229} scrub_opts; 230 231struct queue_opts { 232 int marker; 233#define QOM_BWSPEC 0x01 234#define QOM_SCHEDULER 0x02 235#define QOM_PRIORITY 0x04 236#define QOM_TBRSIZE 0x08 237#define QOM_QLIMIT 0x10 238 struct node_queue_bw queue_bwspec; 239 struct node_queue_opt scheduler; 240 int priority; 241 int tbrsize; 242 int qlimit; 243} queue_opts; 244 245struct table_opts { 246 int flags; 247 int init_addr; 248 struct node_tinithead init_nodes; 249} table_opts; 250 251struct pool_opts { 252 int marker; 253#define POM_TYPE 0x01 254#define POM_STICKYADDRESS 0x02 255 u_int8_t opts; 256 int type; 257 int staticport; 258 struct pf_poolhashkey *key; 259 260} pool_opts; 261 262 263struct node_hfsc_opts hfsc_opts; 264 265int yyerror(const char *, ...); 266int disallow_table(struct node_host *, const char *); 267int disallow_urpf_failed(struct node_host *, const char *); 268int disallow_alias(struct node_host *, const char *); 269int rule_consistent(struct pf_rule *, int); 270int filter_consistent(struct pf_rule *, int); 271int nat_consistent(struct pf_rule *); 272int rdr_consistent(struct pf_rule *); 273int process_tabledef(char *, struct table_opts *); 274int yyparse(void); 275void expand_label_str(char *, size_t, const char *, const char *); 276void expand_label_if(const char *, char *, size_t, const char *); 277void expand_label_addr(const char *, char *, size_t, u_int8_t, 278 struct node_host *); 279void expand_label_port(const char *, char *, size_t, struct node_port *); 280void expand_label_proto(const char *, char *, size_t, u_int8_t); 281void expand_label_nr(const char *, char *, size_t); 282void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 283 struct node_port *, struct node_host *, struct node_port *, 284 u_int8_t); 285void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 286 struct node_proto *, struct node_os*, struct node_host *, 287 struct node_port *, struct node_host *, struct node_port *, 288 struct node_uid *, struct node_gid *, struct node_icmp *, 289 const char *); 290int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 291 struct node_queue_bw bwspec, struct node_queue_opt *); 292int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 293 struct node_queue_bw, struct node_queue_opt *); 294int expand_skip_interface(struct node_if *); 295 296int check_rulestate(int); 297int kw_cmp(const void *, const void *); 298int lookup(char *); 299int lgetc(FILE *); 300int lungetc(int); 301int findeol(void); 302int yylex(void); 303int atoul(char *, u_long *); 304int getservice(char *); 305int rule_label(struct pf_rule *, char *); 306 307TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 308struct sym { 309 TAILQ_ENTRY(sym) entries; 310 int used; 311 int persist; 312 char *nam; 313 char *val; 314}; 315 316 317int symset(const char *, const char *, int); 318char *symget(const char *); 319 320void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 321void decide_address_family(struct node_host *, sa_family_t *); 322void remove_invalid_hosts(struct node_host **, sa_family_t *); 323int invalid_redirect(struct node_host *, sa_family_t); 324u_int16_t parseicmpspec(char *, sa_family_t); 325 326TAILQ_HEAD(loadanchorshead, loadanchors) 327 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 328 329struct loadanchors { 330 TAILQ_ENTRY(loadanchors) entries; 331 char *anchorname; 332 char *filename; 333}; 334 335typedef struct { 336 union { 337 u_int32_t number; 338 int i; 339 char *string; 340 int rtableid; 341 struct { 342 u_int8_t b1; 343 u_int8_t b2; 344 u_int16_t w; 345 u_int16_t w2; 346 } b; 347 struct range { 348 int a; 349 int b; 350 int t; 351 } range; 352 struct node_if *interface; 353 struct node_proto *proto; 354 struct node_icmp *icmp; 355 struct node_host *host; 356 struct node_os *os; 357 struct node_port *port; 358 struct node_uid *uid; 359 struct node_gid *gid; 360 struct node_state_opt *state_opt; 361 struct peer peer; 362 struct { 363 struct peer src, dst; 364 struct node_os *src_os; 365 } fromto; 366 struct { 367 struct node_host *host; 368 u_int8_t rt; 369 u_int8_t pool_opts; 370 sa_family_t af; 371 struct pf_poolhashkey *key; 372 } route; 373 struct redirection { 374 struct node_host *host; 375 struct range rport; 376 } *redirection; 377 struct { 378 int action; 379 struct node_state_opt *options; 380 } keep_state; 381 struct { 382 u_int8_t log; 383 u_int8_t logif; 384 u_int8_t quick; 385 } logquick; 386 struct { 387 int neg; 388 char *name; 389 } tagged; 390 struct pf_poolhashkey *hashkey; 391 struct node_queue *queue; 392 struct node_queue_opt queue_options; 393 struct node_queue_bw queue_bwspec; 394 struct node_qassign qassign; 395 struct filter_opts filter_opts; 396 struct antispoof_opts antispoof_opts; 397 struct queue_opts queue_opts; 398 struct scrub_opts scrub_opts; 399 struct table_opts table_opts; 400 struct pool_opts pool_opts; 401 struct node_hfsc_opts hfsc_opts; 402 } v; 403 int lineno; 404} YYSTYPE; 405 406#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 407 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 408 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 409 410%} 411 412%token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 413%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 414%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 415%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 416%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 417%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 418%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 419%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 420%token ANTISPOOF FOR 421%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 422%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 423%token QUEUE PRIORITY QLIMIT RTABLE 424%token LOAD RULESET_OPTIMIZATION 425%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 426%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH 427%token TAGGED TAG IFBOUND FLOATING STATEPOLICY ROUTE 428%token <v.string> STRING 429%token <v.i> PORTBINARY 430%type <v.interface> interface if_list if_item_not if_item 431%type <v.number> number icmptype icmp6type uid gid 432%type <v.number> tos not yesno 433%type <v.i> no dir af fragcache optimizer 434%type <v.i> sourcetrack flush unaryop statelock 435%type <v.b> action nataction natpass scrubaction 436%type <v.b> flags flag blockspec 437%type <v.range> port rport 438%type <v.hashkey> hashkey 439%type <v.proto> proto proto_list proto_item 440%type <v.icmp> icmpspec 441%type <v.icmp> icmp_list icmp_item 442%type <v.icmp> icmp6_list icmp6_item 443%type <v.fromto> fromto 444%type <v.peer> ipportspec from to 445%type <v.host> ipspec xhost host dynaddr host_list 446%type <v.host> redir_host_list redirspec 447%type <v.host> route_host route_host_list routespec 448%type <v.os> os xos os_list 449%type <v.port> portspec port_list port_item 450%type <v.uid> uids uid_list uid_item 451%type <v.gid> gids gid_list gid_item 452%type <v.route> route 453%type <v.redirection> redirection redirpool 454%type <v.string> label string tag anchorname 455%type <v.keep_state> keep 456%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 457%type <v.logquick> logquick quick log logopts logopt 458%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 459%type <v.qassign> qname 460%type <v.queue> qassign qassign_list qassign_item 461%type <v.queue_options> scheduler 462%type <v.number> cbqflags_list cbqflags_item 463%type <v.number> priqflags_list priqflags_item 464%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 465%type <v.queue_bwspec> bandwidth 466%type <v.filter_opts> filter_opts filter_opt filter_opts_l 467%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 468%type <v.queue_opts> queue_opts queue_opt queue_opts_l 469%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 470%type <v.table_opts> table_opts table_opt table_opts_l 471%type <v.pool_opts> pool_opts pool_opt pool_opts_l 472%type <v.tagged> tagged 473%type <v.rtableid> rtable 474%% 475 476ruleset : /* empty */ 477 | ruleset '\n' 478 | ruleset option '\n' 479 | ruleset scrubrule '\n' 480 | ruleset natrule '\n' 481 | ruleset binatrule '\n' 482 | ruleset pfrule '\n' 483 | ruleset anchorrule '\n' 484 | ruleset loadrule '\n' 485 | ruleset altqif '\n' 486 | ruleset queuespec '\n' 487 | ruleset varset '\n' 488 | ruleset antispoof '\n' 489 | ruleset tabledef '\n' 490 | '{' fakeanchor '}' '\n'; 491 | ruleset error '\n' { errors++; } 492 ; 493 494/* 495 * apply to previouslys specified rule: must be careful to note 496 * what that is: pf or nat or binat or rdr 497 */ 498fakeanchor : fakeanchor '\n' 499 | fakeanchor anchorrule '\n' 500 | fakeanchor binatrule '\n' 501 | fakeanchor natrule '\n' 502 | fakeanchor pfrule '\n' 503 | fakeanchor error '\n' 504 ; 505 506optimizer : string { 507 if (!strcmp($1, "none")) 508 $$ = 0; 509 else if (!strcmp($1, "basic")) 510 $$ = PF_OPTIMIZE_BASIC; 511 else if (!strcmp($1, "profile")) 512 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 513 else { 514 yyerror("unknown ruleset-optimization %s", $$); 515 YYERROR; 516 } 517 } 518 ; 519 520option : SET OPTIMIZATION STRING { 521 if (check_rulestate(PFCTL_STATE_OPTION)) { 522 free($3); 523 YYERROR; 524 } 525 if (pfctl_set_optimization(pf, $3) != 0) { 526 yyerror("unknown optimization %s", $3); 527 free($3); 528 YYERROR; 529 } 530 free($3); 531 } 532 | SET RULESET_OPTIMIZATION optimizer { 533 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 534 pf->opts |= PF_OPT_OPTIMIZE; 535 pf->optimize = $3; 536 } 537 } 538 | SET TIMEOUT timeout_spec 539 | SET TIMEOUT '{' timeout_list '}' 540 | SET LIMIT limit_spec 541 | SET LIMIT '{' limit_list '}' 542 | SET LOGINTERFACE STRING { 543 if (check_rulestate(PFCTL_STATE_OPTION)) { 544 free($3); 545 YYERROR; 546 } 547 if (pfctl_set_logif(pf, $3) != 0) { 548 yyerror("error setting loginterface %s", $3); 549 free($3); 550 YYERROR; 551 } 552 free($3); 553 } 554 | SET HOSTID number { 555 if ($3 == 0) { 556 yyerror("hostid must be non-zero"); 557 YYERROR; 558 } 559 if (pfctl_set_hostid(pf, $3) != 0) { 560 yyerror("error setting hostid %08x", $3); 561 YYERROR; 562 } 563 } 564 | SET BLOCKPOLICY DROP { 565 if (pf->opts & PF_OPT_VERBOSE) 566 printf("set block-policy drop\n"); 567 if (check_rulestate(PFCTL_STATE_OPTION)) 568 YYERROR; 569 blockpolicy = PFRULE_DROP; 570 } 571 | SET BLOCKPOLICY RETURN { 572 if (pf->opts & PF_OPT_VERBOSE) 573 printf("set block-policy return\n"); 574 if (check_rulestate(PFCTL_STATE_OPTION)) 575 YYERROR; 576 blockpolicy = PFRULE_RETURN; 577 } 578 | SET REQUIREORDER yesno { 579 if (pf->opts & PF_OPT_VERBOSE) 580 printf("set require-order %s\n", 581 $3 == 1 ? "yes" : "no"); 582 require_order = $3; 583 } 584 | SET FINGERPRINTS STRING { 585 if (pf->opts & PF_OPT_VERBOSE) 586 printf("set fingerprints \"%s\"\n", $3); 587 if (check_rulestate(PFCTL_STATE_OPTION)) { 588 free($3); 589 YYERROR; 590 } 591 if (!pf->anchor->name[0]) { 592 if (pfctl_file_fingerprints(pf->dev, 593 pf->opts, $3)) { 594 yyerror("error loading " 595 "fingerprints %s", $3); 596 free($3); 597 YYERROR; 598 } 599 } 600 free($3); 601 } 602 | SET STATEPOLICY statelock { 603 if (pf->opts & PF_OPT_VERBOSE) 604 switch ($3) { 605 case 0: 606 printf("set state-policy floating\n"); 607 break; 608 case PFRULE_IFBOUND: 609 printf("set state-policy if-bound\n"); 610 break; 611 } 612 default_statelock = $3; 613 } 614 | SET DEBUG STRING { 615 if (check_rulestate(PFCTL_STATE_OPTION)) { 616 free($3); 617 YYERROR; 618 } 619 if (pfctl_set_debug(pf, $3) != 0) { 620 yyerror("error setting debuglevel %s", $3); 621 free($3); 622 YYERROR; 623 } 624 free($3); 625 } 626 | SET SKIP interface { 627 if (expand_skip_interface($3) != 0) { 628 yyerror("error setting skip interface(s)"); 629 YYERROR; 630 } 631 } 632 ; 633 634string : string STRING { 635 if (asprintf(&$$, "%s %s", $1, $2) == -1) 636 err(1, "string: asprintf"); 637 free($1); 638 free($2); 639 } 640 | STRING 641 ; 642 643varset : STRING '=' string { 644 if (pf->opts & PF_OPT_VERBOSE) 645 printf("%s = \"%s\"\n", $1, $3); 646 if (symset($1, $3, 0) == -1) 647 err(1, "cannot store variable %s", $1); 648 free($1); 649 free($3); 650 } 651 ; 652 653anchorname : STRING { $$ = $1; } 654 | /* empty */ { $$ = NULL; } 655 ; 656 657optnl : optnl '\n' 658 | 659 ; 660 661pfa_anchorlist : pfrule optnl 662 | anchorrule optnl 663 | pfa_anchorlist pfrule optnl 664 | pfa_anchorlist anchorrule optnl 665 ; 666 667pfa_anchor : '{' 668 { 669 char ta[PF_ANCHOR_NAME_SIZE]; 670 struct pf_ruleset *rs; 671 672 /* steping into a brace anchor */ 673 pf->asd++; 674 pf->bn++; 675 pf->brace = 1; 676 677 /* create a holding ruleset in the root */ 678 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 679 rs = pf_find_or_create_ruleset(ta); 680 if (rs == NULL) 681 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 682 pf->astack[pf->asd] = rs->anchor; 683 pf->anchor = rs->anchor; 684 } '\n' pfa_anchorlist '}' 685 { 686 pf->alast = pf->anchor; 687 pf->asd--; 688 pf->anchor = pf->astack[pf->asd]; 689 } 690 | /* empty */ 691 ; 692 693anchorrule : ANCHOR anchorname dir quick interface af proto fromto 694 filter_opts pfa_anchor 695 { 696 struct pf_rule r; 697 698 if (check_rulestate(PFCTL_STATE_FILTER)) { 699 if ($2) 700 free($2); 701 YYERROR; 702 } 703 704 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 705 free($2); 706 yyerror("anchor names beginning with '_' " 707 "are reserved for internal use"); 708 YYERROR; 709 } 710 711 memset(&r, 0, sizeof(r)); 712 if (pf->astack[pf->asd + 1]) { 713 /* move inline rules into relative location */ 714 pf_anchor_setup(&r, 715 &pf->astack[pf->asd]->ruleset, 716 $2 ? $2 : pf->alast->name); 717 718 if (r.anchor == NULL) 719 err(1, "anchorrule: unable to " 720 "create ruleset"); 721 722 if (pf->alast != r.anchor) { 723 if (r.anchor->match) { 724 yyerror("inline anchor '%s' " 725 "already exists", 726 r.anchor->name); 727 YYERROR; 728 } 729 mv_rules(&pf->alast->ruleset, 730 &r.anchor->ruleset); 731 } 732 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 733 pf->alast = r.anchor; 734 } else { 735 if (!$2) { 736 yyerror("anchors without explicit " 737 "rules must specify a name"); 738 YYERROR; 739 } 740 } 741 r.direction = $3; 742 r.quick = $4.quick; 743 r.af = $6; 744 r.prob = $9.prob; 745 r.rtableid = $9.rtableid; 746 747 if ($9.match_tag) 748 if (strlcpy(r.match_tagname, $9.match_tag, 749 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 750 yyerror("tag too long, max %u chars", 751 PF_TAG_NAME_SIZE - 1); 752 YYERROR; 753 } 754 r.match_tag_not = $9.match_tag_not; 755 756 decide_address_family($8.src.host, &r.af); 757 decide_address_family($8.dst.host, &r.af); 758 759 expand_rule(&r, $5, NULL, $7, $8.src_os, 760 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 761 0, 0, 0, pf->astack[pf->asd + 1] ? 762 pf->alast->name : $2); 763 free($2); 764 pf->astack[pf->asd + 1] = NULL; 765 } 766 | NATANCHOR string interface af proto fromto rtable { 767 struct pf_rule r; 768 769 if (check_rulestate(PFCTL_STATE_NAT)) { 770 free($2); 771 YYERROR; 772 } 773 774 memset(&r, 0, sizeof(r)); 775 r.action = PF_NAT; 776 r.af = $4; 777 r.rtableid = $7; 778 779 decide_address_family($6.src.host, &r.af); 780 decide_address_family($6.dst.host, &r.af); 781 782 expand_rule(&r, $3, NULL, $5, $6.src_os, 783 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 784 0, 0, 0, $2); 785 free($2); 786 } 787 | RDRANCHOR string interface af proto fromto rtable { 788 struct pf_rule r; 789 790 if (check_rulestate(PFCTL_STATE_NAT)) { 791 free($2); 792 YYERROR; 793 } 794 795 memset(&r, 0, sizeof(r)); 796 r.action = PF_RDR; 797 r.af = $4; 798 r.rtableid = $7; 799 800 decide_address_family($6.src.host, &r.af); 801 decide_address_family($6.dst.host, &r.af); 802 803 if ($6.src.port != NULL) { 804 yyerror("source port parameter not supported" 805 " in rdr-anchor"); 806 YYERROR; 807 } 808 if ($6.dst.port != NULL) { 809 if ($6.dst.port->next != NULL) { 810 yyerror("destination port list " 811 "expansion not supported in " 812 "rdr-anchor"); 813 YYERROR; 814 } else if ($6.dst.port->op != PF_OP_EQ) { 815 yyerror("destination port operators" 816 " not supported in rdr-anchor"); 817 YYERROR; 818 } 819 r.dst.port[0] = $6.dst.port->port[0]; 820 r.dst.port[1] = $6.dst.port->port[1]; 821 r.dst.port_op = $6.dst.port->op; 822 } 823 824 expand_rule(&r, $3, NULL, $5, $6.src_os, 825 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 826 0, 0, 0, $2); 827 free($2); 828 } 829 | BINATANCHOR string interface af proto fromto rtable { 830 struct pf_rule r; 831 832 if (check_rulestate(PFCTL_STATE_NAT)) { 833 free($2); 834 YYERROR; 835 } 836 837 memset(&r, 0, sizeof(r)); 838 r.action = PF_BINAT; 839 r.af = $4; 840 r.rtableid = $7; 841 if ($5 != NULL) { 842 if ($5->next != NULL) { 843 yyerror("proto list expansion" 844 " not supported in binat-anchor"); 845 YYERROR; 846 } 847 r.proto = $5->proto; 848 free($5); 849 } 850 851 if ($6.src.host != NULL || $6.src.port != NULL || 852 $6.dst.host != NULL || $6.dst.port != NULL) { 853 yyerror("fromto parameter not supported" 854 " in binat-anchor"); 855 YYERROR; 856 } 857 858 decide_address_family($6.src.host, &r.af); 859 decide_address_family($6.dst.host, &r.af); 860 861 pfctl_add_rule(pf, &r, $2); 862 free($2); 863 } 864 ; 865 866loadrule : LOAD ANCHOR string FROM string { 867 struct loadanchors *loadanchor; 868 869 if (strlen(pf->anchor->name) + 1 + 870 strlen($3) >= MAXPATHLEN) { 871 yyerror("anchorname %s too long, max %u\n", 872 $3, MAXPATHLEN - 1); 873 free($3); 874 YYERROR; 875 } 876 loadanchor = calloc(1, sizeof(struct loadanchors)); 877 if (loadanchor == NULL) 878 err(1, "loadrule: calloc"); 879 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 880 NULL) 881 err(1, "loadrule: malloc"); 882 if (pf->anchor->name[0]) 883 snprintf(loadanchor->anchorname, MAXPATHLEN, 884 "%s/%s", pf->anchor->name, $3); 885 else 886 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 887 if ((loadanchor->filename = strdup($5)) == NULL) 888 err(1, "loadrule: strdup"); 889 890 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 891 entries); 892 893 free($3); 894 free($5); 895 }; 896 897scrubaction : no SCRUB { 898 $$.b2 = $$.w = 0; 899 if ($1) 900 $$.b1 = PF_NOSCRUB; 901 else 902 $$.b1 = PF_SCRUB; 903 } 904 ; 905 906scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 907 { 908 struct pf_rule r; 909 910 if (check_rulestate(PFCTL_STATE_SCRUB)) 911 YYERROR; 912 913 memset(&r, 0, sizeof(r)); 914 915 r.action = $1.b1; 916 r.direction = $2; 917 918 r.log = $3.log; 919 r.logif = $3.logif; 920 if ($3.quick) { 921 yyerror("scrub rules do not support 'quick'"); 922 YYERROR; 923 } 924 925 r.af = $5; 926 if ($8.nodf) 927 r.rule_flag |= PFRULE_NODF; 928 if ($8.randomid) 929 r.rule_flag |= PFRULE_RANDOMID; 930 if ($8.reassemble_tcp) { 931 if (r.direction != PF_INOUT) { 932 yyerror("reassemble tcp rules can not " 933 "specify direction"); 934 YYERROR; 935 } 936 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 937 } 938 if ($8.minttl) 939 r.min_ttl = $8.minttl; 940 if ($8.maxmss) 941 r.max_mss = $8.maxmss; 942 if ($8.fragcache) 943 r.rule_flag |= $8.fragcache; 944 r.rtableid = $8.rtableid; 945 946 expand_rule(&r, $4, NULL, $6, $7.src_os, 947 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 948 NULL, NULL, NULL, ""); 949 } 950 ; 951 952scrub_opts : { 953 bzero(&scrub_opts, sizeof scrub_opts); 954 scrub_opts.rtableid = -1; 955 } 956 scrub_opts_l 957 { $$ = scrub_opts; } 958 | /* empty */ { 959 bzero(&scrub_opts, sizeof scrub_opts); 960 scrub_opts.rtableid = -1; 961 $$ = scrub_opts; 962 } 963 ; 964 965scrub_opts_l : scrub_opts_l scrub_opt 966 | scrub_opt 967 ; 968 969scrub_opt : NODF { 970 if (scrub_opts.nodf) { 971 yyerror("no-df cannot be respecified"); 972 YYERROR; 973 } 974 scrub_opts.nodf = 1; 975 } 976 | MINTTL number { 977 if (scrub_opts.marker & SOM_MINTTL) { 978 yyerror("min-ttl cannot be respecified"); 979 YYERROR; 980 } 981 if ($2 > 255) { 982 yyerror("illegal min-ttl value %d", $2); 983 YYERROR; 984 } 985 scrub_opts.marker |= SOM_MINTTL; 986 scrub_opts.minttl = $2; 987 } 988 | MAXMSS number { 989 if (scrub_opts.marker & SOM_MAXMSS) { 990 yyerror("max-mss cannot be respecified"); 991 YYERROR; 992 } 993 if ($2 > 65535) { 994 yyerror("illegal max-mss value %d", $2); 995 YYERROR; 996 } 997 scrub_opts.marker |= SOM_MAXMSS; 998 scrub_opts.maxmss = $2; 999 } 1000 | fragcache { 1001 if (scrub_opts.marker & SOM_FRAGCACHE) { 1002 yyerror("fragcache cannot be respecified"); 1003 YYERROR; 1004 } 1005 scrub_opts.marker |= SOM_FRAGCACHE; 1006 scrub_opts.fragcache = $1; 1007 } 1008 | REASSEMBLE STRING { 1009 if (strcasecmp($2, "tcp") != 0) { 1010 yyerror("scrub reassemble supports only tcp, " 1011 "not '%s'", $2); 1012 free($2); 1013 YYERROR; 1014 } 1015 free($2); 1016 if (scrub_opts.reassemble_tcp) { 1017 yyerror("reassemble tcp cannot be respecified"); 1018 YYERROR; 1019 } 1020 scrub_opts.reassemble_tcp = 1; 1021 } 1022 | RANDOMID { 1023 if (scrub_opts.randomid) { 1024 yyerror("random-id cannot be respecified"); 1025 YYERROR; 1026 } 1027 scrub_opts.randomid = 1; 1028 } 1029 | RTABLE number { 1030#ifdef __FreeBSD__ 1031 yyerror("rtable id not supported in FreeBSD, yet"); 1032 YYERROR; 1033#else 1034 if ($2 > RT_TABLEID_MAX || $2 < 0) { 1035 yyerror("invalid rtable id"); 1036 YYERROR; 1037 } 1038 scrub_opts.rtableid = $2; 1039#endif 1040 } 1041 ; 1042 1043fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 1044 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 1045 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 1046 ; 1047 1048antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1049 struct pf_rule r; 1050 struct node_host *h = NULL, *hh; 1051 struct node_if *i, *j; 1052 1053 if (check_rulestate(PFCTL_STATE_FILTER)) 1054 YYERROR; 1055 1056 for (i = $3; i; i = i->next) { 1057 bzero(&r, sizeof(r)); 1058 1059 r.action = PF_DROP; 1060 r.direction = PF_IN; 1061 r.log = $2.log; 1062 r.logif = $2.logif; 1063 r.quick = $2.quick; 1064 r.af = $4; 1065 if (rule_label(&r, $5.label)) 1066 YYERROR; 1067 r.rtableid = $5.rtableid; 1068 j = calloc(1, sizeof(struct node_if)); 1069 if (j == NULL) 1070 err(1, "antispoof: calloc"); 1071 if (strlcpy(j->ifname, i->ifname, 1072 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1073 free(j); 1074 yyerror("interface name too long"); 1075 YYERROR; 1076 } 1077 j->not = 1; 1078 if (i->dynamic) { 1079 h = calloc(1, sizeof(*h)); 1080 if (h == NULL) 1081 err(1, "address: calloc"); 1082 h->addr.type = PF_ADDR_DYNIFTL; 1083 set_ipmask(h, 128); 1084 if (strlcpy(h->addr.v.ifname, i->ifname, 1085 sizeof(h->addr.v.ifname)) >= 1086 sizeof(h->addr.v.ifname)) { 1087 free(h); 1088 yyerror( 1089 "interface name too long"); 1090 YYERROR; 1091 } 1092 hh = malloc(sizeof(*hh)); 1093 if (hh == NULL) 1094 err(1, "address: malloc"); 1095 bcopy(h, hh, sizeof(*hh)); 1096 h->addr.iflags = PFI_AFLAG_NETWORK; 1097 } else { 1098 h = ifa_lookup(j->ifname, 1099 PFI_AFLAG_NETWORK); 1100 hh = NULL; 1101 } 1102 1103 if (h != NULL) 1104 expand_rule(&r, j, NULL, NULL, NULL, h, 1105 NULL, NULL, NULL, NULL, NULL, 1106 NULL, ""); 1107 1108 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1109 bzero(&r, sizeof(r)); 1110 1111 r.action = PF_DROP; 1112 r.direction = PF_IN; 1113 r.log = $2.log; 1114 r.quick = $2.quick; 1115 r.af = $4; 1116 if (rule_label(&r, $5.label)) 1117 YYERROR; 1118 r.rtableid = $5.rtableid; 1119 if (hh != NULL) 1120 h = hh; 1121 else 1122 h = ifa_lookup(i->ifname, 0); 1123 if (h != NULL) 1124 expand_rule(&r, NULL, NULL, 1125 NULL, NULL, h, NULL, NULL, 1126 NULL, NULL, NULL, NULL, ""); 1127 } else 1128 free(hh); 1129 } 1130 free($5.label); 1131 } 1132 ; 1133 1134antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1135 | FOR '{' antispoof_iflst '}' { $$ = $3; } 1136 ; 1137 1138antispoof_iflst : antispoof_if { $$ = $1; } 1139 | antispoof_iflst comma antispoof_if { 1140 $1->tail->next = $3; 1141 $1->tail = $3; 1142 $$ = $1; 1143 } 1144 ; 1145 1146antispoof_if : if_item { $$ = $1; } 1147 | '(' if_item ')' { 1148 $2->dynamic = 1; 1149 $$ = $2; 1150 } 1151 ; 1152 1153antispoof_opts : { 1154 bzero(&antispoof_opts, sizeof antispoof_opts); 1155 antispoof_opts.rtableid = -1; 1156 } 1157 antispoof_opts_l 1158 { $$ = antispoof_opts; } 1159 | /* empty */ { 1160 bzero(&antispoof_opts, sizeof antispoof_opts); 1161 antispoof_opts.rtableid = -1; 1162 $$ = antispoof_opts; 1163 } 1164 ; 1165 1166antispoof_opts_l : antispoof_opts_l antispoof_opt 1167 | antispoof_opt 1168 ; 1169 1170antispoof_opt : label { 1171 if (antispoof_opts.label) { 1172 yyerror("label cannot be redefined"); 1173 YYERROR; 1174 } 1175 antispoof_opts.label = $1; 1176 } 1177 | RTABLE number { 1178#ifdef __FreeBSD__ 1179 yyerror("rtable id not supported in FreeBSD, yet"); 1180 YYERROR; 1181#else 1182 if ($2 > RT_TABLEID_MAX || $2 < 0) { 1183 yyerror("invalid rtable id"); 1184 YYERROR; 1185 } 1186 antispoof_opts.rtableid = $2; 1187#endif 1188 } 1189 ; 1190 1191not : '!' { $$ = 1; } 1192 | /* empty */ { $$ = 0; } 1193 ; 1194 1195tabledef : TABLE '<' STRING '>' table_opts { 1196 struct node_host *h, *nh; 1197 struct node_tinit *ti, *nti; 1198 1199 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1200 yyerror("table name too long, max %d chars", 1201 PF_TABLE_NAME_SIZE - 1); 1202 free($3); 1203 YYERROR; 1204 } 1205 if (pf->loadopt & PFCTL_FLAG_TABLE) 1206 if (process_tabledef($3, &$5)) { 1207 free($3); 1208 YYERROR; 1209 } 1210 free($3); 1211 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1212 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1213 if (ti->file) 1214 free(ti->file); 1215 for (h = ti->host; h != NULL; h = nh) { 1216 nh = h->next; 1217 free(h); 1218 } 1219 nti = SIMPLEQ_NEXT(ti, entries); 1220 free(ti); 1221 } 1222 } 1223 ; 1224 1225table_opts : { 1226 bzero(&table_opts, sizeof table_opts); 1227 SIMPLEQ_INIT(&table_opts.init_nodes); 1228 } 1229 table_opts_l 1230 { $$ = table_opts; } 1231 | /* empty */ 1232 { 1233 bzero(&table_opts, sizeof table_opts); 1234 SIMPLEQ_INIT(&table_opts.init_nodes); 1235 $$ = table_opts; 1236 } 1237 ; 1238 1239table_opts_l : table_opts_l table_opt 1240 | table_opt 1241 ; 1242 1243table_opt : STRING { 1244 if (!strcmp($1, "const")) 1245 table_opts.flags |= PFR_TFLAG_CONST; 1246 else if (!strcmp($1, "persist")) 1247 table_opts.flags |= PFR_TFLAG_PERSIST; 1248 else { 1249 yyerror("invalid table option '%s'", $1); 1250 free($1); 1251 YYERROR; 1252 } 1253 free($1); 1254 } 1255 | '{' '}' { table_opts.init_addr = 1; } 1256 | '{' host_list '}' { 1257 struct node_host *n; 1258 struct node_tinit *ti; 1259 1260 for (n = $2; n != NULL; n = n->next) { 1261 switch (n->addr.type) { 1262 case PF_ADDR_ADDRMASK: 1263 continue; /* ok */ 1264 case PF_ADDR_DYNIFTL: 1265 yyerror("dynamic addresses are not " 1266 "permitted inside tables"); 1267 break; 1268 case PF_ADDR_TABLE: 1269 yyerror("tables cannot contain tables"); 1270 break; 1271 case PF_ADDR_NOROUTE: 1272 yyerror("\"no-route\" is not permitted " 1273 "inside tables"); 1274 break; 1275 case PF_ADDR_URPFFAILED: 1276 yyerror("\"urpf-failed\" is not " 1277 "permitted inside tables"); 1278 break; 1279 default: 1280 yyerror("unknown address type %d", 1281 n->addr.type); 1282 } 1283 YYERROR; 1284 } 1285 if (!(ti = calloc(1, sizeof(*ti)))) 1286 err(1, "table_opt: calloc"); 1287 ti->host = $2; 1288 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1289 entries); 1290 table_opts.init_addr = 1; 1291 } 1292 | FILENAME STRING { 1293 struct node_tinit *ti; 1294 1295 if (!(ti = calloc(1, sizeof(*ti)))) 1296 err(1, "table_opt: calloc"); 1297 ti->file = $2; 1298 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1299 entries); 1300 table_opts.init_addr = 1; 1301 } 1302 ; 1303 1304altqif : ALTQ interface queue_opts QUEUE qassign { 1305 struct pf_altq a; 1306 1307 if (check_rulestate(PFCTL_STATE_QUEUE)) 1308 YYERROR; 1309 1310 memset(&a, 0, sizeof(a)); 1311 if ($3.scheduler.qtype == ALTQT_NONE) { 1312 yyerror("no scheduler specified!"); 1313 YYERROR; 1314 } 1315 a.scheduler = $3.scheduler.qtype; 1316 a.qlimit = $3.qlimit; 1317 a.tbrsize = $3.tbrsize; 1318 if ($5 == NULL) { 1319 yyerror("no child queues specified"); 1320 YYERROR; 1321 } 1322 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1323 &$3.scheduler)) 1324 YYERROR; 1325 } 1326 ; 1327 1328queuespec : QUEUE STRING interface queue_opts qassign { 1329 struct pf_altq a; 1330 1331 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1332 free($2); 1333 YYERROR; 1334 } 1335 1336 memset(&a, 0, sizeof(a)); 1337 1338 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1339 sizeof(a.qname)) { 1340 yyerror("queue name too long (max " 1341 "%d chars)", PF_QNAME_SIZE-1); 1342 free($2); 1343 YYERROR; 1344 } 1345 free($2); 1346 if ($4.tbrsize) { 1347 yyerror("cannot specify tbrsize for queue"); 1348 YYERROR; 1349 } 1350 if ($4.priority > 255) { 1351 yyerror("priority out of range: max 255"); 1352 YYERROR; 1353 } 1354 a.priority = $4.priority; 1355 a.qlimit = $4.qlimit; 1356 a.scheduler = $4.scheduler.qtype; 1357 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1358 &$4.scheduler)) { 1359 yyerror("errors in queue definition"); 1360 YYERROR; 1361 } 1362 } 1363 ; 1364 1365queue_opts : { 1366 bzero(&queue_opts, sizeof queue_opts); 1367 queue_opts.priority = DEFAULT_PRIORITY; 1368 queue_opts.qlimit = DEFAULT_QLIMIT; 1369 queue_opts.scheduler.qtype = ALTQT_NONE; 1370 queue_opts.queue_bwspec.bw_percent = 100; 1371 } 1372 queue_opts_l 1373 { $$ = queue_opts; } 1374 | /* empty */ { 1375 bzero(&queue_opts, sizeof queue_opts); 1376 queue_opts.priority = DEFAULT_PRIORITY; 1377 queue_opts.qlimit = DEFAULT_QLIMIT; 1378 queue_opts.scheduler.qtype = ALTQT_NONE; 1379 queue_opts.queue_bwspec.bw_percent = 100; 1380 $$ = queue_opts; 1381 } 1382 ; 1383 1384queue_opts_l : queue_opts_l queue_opt 1385 | queue_opt 1386 ; 1387 1388queue_opt : BANDWIDTH bandwidth { 1389 if (queue_opts.marker & QOM_BWSPEC) { 1390 yyerror("bandwidth cannot be respecified"); 1391 YYERROR; 1392 } 1393 queue_opts.marker |= QOM_BWSPEC; 1394 queue_opts.queue_bwspec = $2; 1395 } 1396 | PRIORITY number { 1397 if (queue_opts.marker & QOM_PRIORITY) { 1398 yyerror("priority cannot be respecified"); 1399 YYERROR; 1400 } 1401 if ($2 > 255) { 1402 yyerror("priority out of range: max 255"); 1403 YYERROR; 1404 } 1405 queue_opts.marker |= QOM_PRIORITY; 1406 queue_opts.priority = $2; 1407 } 1408 | QLIMIT number { 1409 if (queue_opts.marker & QOM_QLIMIT) { 1410 yyerror("qlimit cannot be respecified"); 1411 YYERROR; 1412 } 1413 if ($2 > 65535) { 1414 yyerror("qlimit out of range: max 65535"); 1415 YYERROR; 1416 } 1417 queue_opts.marker |= QOM_QLIMIT; 1418 queue_opts.qlimit = $2; 1419 } 1420 | scheduler { 1421 if (queue_opts.marker & QOM_SCHEDULER) { 1422 yyerror("scheduler cannot be respecified"); 1423 YYERROR; 1424 } 1425 queue_opts.marker |= QOM_SCHEDULER; 1426 queue_opts.scheduler = $1; 1427 } 1428 | TBRSIZE number { 1429 if (queue_opts.marker & QOM_TBRSIZE) { 1430 yyerror("tbrsize cannot be respecified"); 1431 YYERROR; 1432 } 1433 if ($2 > 65535) { 1434 yyerror("tbrsize too big: max 65535"); 1435 YYERROR; 1436 } 1437 queue_opts.marker |= QOM_TBRSIZE; 1438 queue_opts.tbrsize = $2; 1439 } 1440 ; 1441 1442bandwidth : STRING { 1443 double bps; 1444 char *cp; 1445 1446 $$.bw_percent = 0; 1447 1448 bps = strtod($1, &cp); 1449 if (cp != NULL) { 1450 if (!strcmp(cp, "b")) 1451 ; /* nothing */ 1452 else if (!strcmp(cp, "Kb")) 1453 bps *= 1000; 1454 else if (!strcmp(cp, "Mb")) 1455 bps *= 1000 * 1000; 1456 else if (!strcmp(cp, "Gb")) 1457 bps *= 1000 * 1000 * 1000; 1458 else if (!strcmp(cp, "%")) { 1459 if (bps < 0 || bps > 100) { 1460 yyerror("bandwidth spec " 1461 "out of range"); 1462 free($1); 1463 YYERROR; 1464 } 1465 $$.bw_percent = bps; 1466 bps = 0; 1467 } else { 1468 yyerror("unknown unit %s", cp); 1469 free($1); 1470 YYERROR; 1471 } 1472 } 1473 free($1); 1474 $$.bw_absolute = (u_int32_t)bps; 1475 } 1476 ; 1477 1478scheduler : CBQ { 1479 $$.qtype = ALTQT_CBQ; 1480 $$.data.cbq_opts.flags = 0; 1481 } 1482 | CBQ '(' cbqflags_list ')' { 1483 $$.qtype = ALTQT_CBQ; 1484 $$.data.cbq_opts.flags = $3; 1485 } 1486 | PRIQ { 1487 $$.qtype = ALTQT_PRIQ; 1488 $$.data.priq_opts.flags = 0; 1489 } 1490 | PRIQ '(' priqflags_list ')' { 1491 $$.qtype = ALTQT_PRIQ; 1492 $$.data.priq_opts.flags = $3; 1493 } 1494 | HFSC { 1495 $$.qtype = ALTQT_HFSC; 1496 bzero(&$$.data.hfsc_opts, 1497 sizeof(struct node_hfsc_opts)); 1498 } 1499 | HFSC '(' hfsc_opts ')' { 1500 $$.qtype = ALTQT_HFSC; 1501 $$.data.hfsc_opts = $3; 1502 } 1503 ; 1504 1505cbqflags_list : cbqflags_item { $$ |= $1; } 1506 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1507 ; 1508 1509cbqflags_item : STRING { 1510 if (!strcmp($1, "default")) 1511 $$ = CBQCLF_DEFCLASS; 1512 else if (!strcmp($1, "borrow")) 1513 $$ = CBQCLF_BORROW; 1514 else if (!strcmp($1, "red")) 1515 $$ = CBQCLF_RED; 1516 else if (!strcmp($1, "ecn")) 1517 $$ = CBQCLF_RED|CBQCLF_ECN; 1518 else if (!strcmp($1, "rio")) 1519 $$ = CBQCLF_RIO; 1520 else { 1521 yyerror("unknown cbq flag \"%s\"", $1); 1522 free($1); 1523 YYERROR; 1524 } 1525 free($1); 1526 } 1527 ; 1528 1529priqflags_list : priqflags_item { $$ |= $1; } 1530 | priqflags_list comma priqflags_item { $$ |= $3; } 1531 ; 1532 1533priqflags_item : STRING { 1534 if (!strcmp($1, "default")) 1535 $$ = PRCF_DEFAULTCLASS; 1536 else if (!strcmp($1, "red")) 1537 $$ = PRCF_RED; 1538 else if (!strcmp($1, "ecn")) 1539 $$ = PRCF_RED|PRCF_ECN; 1540 else if (!strcmp($1, "rio")) 1541 $$ = PRCF_RIO; 1542 else { 1543 yyerror("unknown priq flag \"%s\"", $1); 1544 free($1); 1545 YYERROR; 1546 } 1547 free($1); 1548 } 1549 ; 1550 1551hfsc_opts : { 1552 bzero(&hfsc_opts, 1553 sizeof(struct node_hfsc_opts)); 1554 } 1555 hfscopts_list { 1556 $$ = hfsc_opts; 1557 } 1558 ; 1559 1560hfscopts_list : hfscopts_item 1561 | hfscopts_list comma hfscopts_item 1562 ; 1563 1564hfscopts_item : LINKSHARE bandwidth { 1565 if (hfsc_opts.linkshare.used) { 1566 yyerror("linkshare already specified"); 1567 YYERROR; 1568 } 1569 hfsc_opts.linkshare.m2 = $2; 1570 hfsc_opts.linkshare.used = 1; 1571 } 1572 | LINKSHARE '(' bandwidth comma number comma bandwidth ')' 1573 { 1574 if (hfsc_opts.linkshare.used) { 1575 yyerror("linkshare already specified"); 1576 YYERROR; 1577 } 1578 hfsc_opts.linkshare.m1 = $3; 1579 hfsc_opts.linkshare.d = $5; 1580 hfsc_opts.linkshare.m2 = $7; 1581 hfsc_opts.linkshare.used = 1; 1582 } 1583 | REALTIME bandwidth { 1584 if (hfsc_opts.realtime.used) { 1585 yyerror("realtime already specified"); 1586 YYERROR; 1587 } 1588 hfsc_opts.realtime.m2 = $2; 1589 hfsc_opts.realtime.used = 1; 1590 } 1591 | REALTIME '(' bandwidth comma number comma bandwidth ')' 1592 { 1593 if (hfsc_opts.realtime.used) { 1594 yyerror("realtime already specified"); 1595 YYERROR; 1596 } 1597 hfsc_opts.realtime.m1 = $3; 1598 hfsc_opts.realtime.d = $5; 1599 hfsc_opts.realtime.m2 = $7; 1600 hfsc_opts.realtime.used = 1; 1601 } 1602 | UPPERLIMIT bandwidth { 1603 if (hfsc_opts.upperlimit.used) { 1604 yyerror("upperlimit already specified"); 1605 YYERROR; 1606 } 1607 hfsc_opts.upperlimit.m2 = $2; 1608 hfsc_opts.upperlimit.used = 1; 1609 } 1610 | UPPERLIMIT '(' bandwidth comma number comma bandwidth ')' 1611 { 1612 if (hfsc_opts.upperlimit.used) { 1613 yyerror("upperlimit already specified"); 1614 YYERROR; 1615 } 1616 hfsc_opts.upperlimit.m1 = $3; 1617 hfsc_opts.upperlimit.d = $5; 1618 hfsc_opts.upperlimit.m2 = $7; 1619 hfsc_opts.upperlimit.used = 1; 1620 } 1621 | STRING { 1622 if (!strcmp($1, "default")) 1623 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1624 else if (!strcmp($1, "red")) 1625 hfsc_opts.flags |= HFCF_RED; 1626 else if (!strcmp($1, "ecn")) 1627 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1628 else if (!strcmp($1, "rio")) 1629 hfsc_opts.flags |= HFCF_RIO; 1630 else { 1631 yyerror("unknown hfsc flag \"%s\"", $1); 1632 free($1); 1633 YYERROR; 1634 } 1635 free($1); 1636 } 1637 ; 1638 1639qassign : /* empty */ { $$ = NULL; } 1640 | qassign_item { $$ = $1; } 1641 | '{' qassign_list '}' { $$ = $2; } 1642 ; 1643 1644qassign_list : qassign_item { $$ = $1; } 1645 | qassign_list comma qassign_item { 1646 $1->tail->next = $3; 1647 $1->tail = $3; 1648 $$ = $1; 1649 } 1650 ; 1651 1652qassign_item : STRING { 1653 $$ = calloc(1, sizeof(struct node_queue)); 1654 if ($$ == NULL) 1655 err(1, "qassign_item: calloc"); 1656 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1657 sizeof($$->queue)) { 1658 yyerror("queue name '%s' too long (max " 1659 "%d chars)", $1, sizeof($$->queue)-1); 1660 free($1); 1661 free($$); 1662 YYERROR; 1663 } 1664 free($1); 1665 $$->next = NULL; 1666 $$->tail = $$; 1667 } 1668 ; 1669 1670pfrule : action dir logquick interface route af proto fromto 1671 filter_opts 1672 { 1673 struct pf_rule r; 1674 struct node_state_opt *o; 1675 struct node_proto *proto; 1676 int srctrack = 0; 1677 int statelock = 0; 1678 int adaptive = 0; 1679 1680 if (check_rulestate(PFCTL_STATE_FILTER)) 1681 YYERROR; 1682 1683 memset(&r, 0, sizeof(r)); 1684 1685 r.action = $1.b1; 1686 switch ($1.b2) { 1687 case PFRULE_RETURNRST: 1688 r.rule_flag |= PFRULE_RETURNRST; 1689 r.return_ttl = $1.w; 1690 break; 1691 case PFRULE_RETURNICMP: 1692 r.rule_flag |= PFRULE_RETURNICMP; 1693 r.return_icmp = $1.w; 1694 r.return_icmp6 = $1.w2; 1695 break; 1696 case PFRULE_RETURN: 1697 r.rule_flag |= PFRULE_RETURN; 1698 r.return_icmp = $1.w; 1699 r.return_icmp6 = $1.w2; 1700 break; 1701 } 1702 r.direction = $2; 1703 r.log = $3.log; 1704 r.logif = $3.logif; 1705 r.quick = $3.quick; 1706 r.prob = $9.prob; 1707 r.rtableid = $9.rtableid; 1708 1709 r.af = $6; 1710 if ($9.tag) 1711 if (strlcpy(r.tagname, $9.tag, 1712 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1713 yyerror("tag too long, max %u chars", 1714 PF_TAG_NAME_SIZE - 1); 1715 YYERROR; 1716 } 1717 if ($9.match_tag) 1718 if (strlcpy(r.match_tagname, $9.match_tag, 1719 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1720 yyerror("tag too long, max %u chars", 1721 PF_TAG_NAME_SIZE - 1); 1722 YYERROR; 1723 } 1724 r.match_tag_not = $9.match_tag_not; 1725 if (rule_label(&r, $9.label)) 1726 YYERROR; 1727 free($9.label); 1728 r.flags = $9.flags.b1; 1729 r.flagset = $9.flags.b2; 1730 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 1731 yyerror("flags always false"); 1732 YYERROR; 1733 } 1734 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1735 for (proto = $7; proto != NULL && 1736 proto->proto != IPPROTO_TCP; 1737 proto = proto->next) 1738 ; /* nothing */ 1739 if (proto == NULL && $7 != NULL) { 1740 if ($9.flags.b1 || $9.flags.b2) 1741 yyerror( 1742 "flags only apply to tcp"); 1743 if ($8.src_os) 1744 yyerror( 1745 "OS fingerprinting only " 1746 "apply to tcp"); 1747 YYERROR; 1748 } 1749#if 0 1750 if (($9.flags.b1 & parse_flags("S")) == 0 && 1751 $8.src_os) { 1752 yyerror("OS fingerprinting requires " 1753 "the SYN TCP flag (flags S/SA)"); 1754 YYERROR; 1755 } 1756#endif 1757 } 1758 1759 r.tos = $9.tos; 1760 r.keep_state = $9.keep.action; 1761 1762 /* 'keep state' by default on pass rules. */ 1763 if (!r.keep_state && !r.action && 1764 !($9.marker & FOM_KEEP)) 1765 r.keep_state = PF_STATE_NORMAL; 1766 1767 o = $9.keep.options; 1768 while (o) { 1769 struct node_state_opt *p = o; 1770 1771 switch (o->type) { 1772 case PF_STATE_OPT_MAX: 1773 if (r.max_states) { 1774 yyerror("state option 'max' " 1775 "multiple definitions"); 1776 YYERROR; 1777 } 1778 r.max_states = o->data.max_states; 1779 break; 1780 case PF_STATE_OPT_NOSYNC: 1781 if (r.rule_flag & PFRULE_NOSYNC) { 1782 yyerror("state option 'sync' " 1783 "multiple definitions"); 1784 YYERROR; 1785 } 1786 r.rule_flag |= PFRULE_NOSYNC; 1787 break; 1788 case PF_STATE_OPT_SRCTRACK: 1789 if (srctrack) { 1790 yyerror("state option " 1791 "'source-track' " 1792 "multiple definitions"); 1793 YYERROR; 1794 } 1795 srctrack = o->data.src_track; 1796 r.rule_flag |= PFRULE_SRCTRACK; 1797 break; 1798 case PF_STATE_OPT_MAX_SRC_STATES: 1799 if (r.max_src_states) { 1800 yyerror("state option " 1801 "'max-src-states' " 1802 "multiple definitions"); 1803 YYERROR; 1804 } 1805 if (o->data.max_src_states == 0) { 1806 yyerror("'max-src-states' must " 1807 "be > 0"); 1808 YYERROR; 1809 } 1810 r.max_src_states = 1811 o->data.max_src_states; 1812 r.rule_flag |= PFRULE_SRCTRACK; 1813 break; 1814 case PF_STATE_OPT_OVERLOAD: 1815 if (r.overload_tblname[0]) { 1816 yyerror("multiple 'overload' " 1817 "table definitions"); 1818 YYERROR; 1819 } 1820 if (strlcpy(r.overload_tblname, 1821 o->data.overload.tblname, 1822 PF_TABLE_NAME_SIZE) >= 1823 PF_TABLE_NAME_SIZE) { 1824 yyerror("state option: " 1825 "strlcpy"); 1826 YYERROR; 1827 } 1828 r.flush = o->data.overload.flush; 1829 break; 1830 case PF_STATE_OPT_MAX_SRC_CONN: 1831 if (r.max_src_conn) { 1832 yyerror("state option " 1833 "'max-src-conn' " 1834 "multiple definitions"); 1835 YYERROR; 1836 } 1837 if (o->data.max_src_conn == 0) { 1838 yyerror("'max-src-conn' " 1839 "must be > 0"); 1840 YYERROR; 1841 } 1842 r.max_src_conn = 1843 o->data.max_src_conn; 1844 r.rule_flag |= PFRULE_SRCTRACK | 1845 PFRULE_RULESRCTRACK; 1846 break; 1847 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1848 if (r.max_src_conn_rate.limit) { 1849 yyerror("state option " 1850 "'max-src-conn-rate' " 1851 "multiple definitions"); 1852 YYERROR; 1853 } 1854 if (!o->data.max_src_conn_rate.limit || 1855 !o->data.max_src_conn_rate.seconds) { 1856 yyerror("'max-src-conn-rate' " 1857 "values must be > 0"); 1858 YYERROR; 1859 } 1860 if (o->data.max_src_conn_rate.limit > 1861 PF_THRESHOLD_MAX) { 1862 yyerror("'max-src-conn-rate' " 1863 "maximum rate must be < %u", 1864 PF_THRESHOLD_MAX); 1865 YYERROR; 1866 } 1867 r.max_src_conn_rate.limit = 1868 o->data.max_src_conn_rate.limit; 1869 r.max_src_conn_rate.seconds = 1870 o->data.max_src_conn_rate.seconds; 1871 r.rule_flag |= PFRULE_SRCTRACK | 1872 PFRULE_RULESRCTRACK; 1873 break; 1874 case PF_STATE_OPT_MAX_SRC_NODES: 1875 if (r.max_src_nodes) { 1876 yyerror("state option " 1877 "'max-src-nodes' " 1878 "multiple definitions"); 1879 YYERROR; 1880 } 1881 if (o->data.max_src_nodes == 0) { 1882 yyerror("'max-src-nodes' must " 1883 "be > 0"); 1884 YYERROR; 1885 } 1886 r.max_src_nodes = 1887 o->data.max_src_nodes; 1888 r.rule_flag |= PFRULE_SRCTRACK | 1889 PFRULE_RULESRCTRACK; 1890 break; 1891 case PF_STATE_OPT_STATELOCK: 1892 if (statelock) { 1893 yyerror("state locking option: " 1894 "multiple definitions"); 1895 YYERROR; 1896 } 1897 statelock = 1; 1898 r.rule_flag |= o->data.statelock; 1899 break; 1900 case PF_STATE_OPT_TIMEOUT: 1901 if (o->data.timeout.number == 1902 PFTM_ADAPTIVE_START || 1903 o->data.timeout.number == 1904 PFTM_ADAPTIVE_END) 1905 adaptive = 1; 1906 if (r.timeout[o->data.timeout.number]) { 1907 yyerror("state timeout %s " 1908 "multiple definitions", 1909 pf_timeouts[o->data. 1910 timeout.number].name); 1911 YYERROR; 1912 } 1913 r.timeout[o->data.timeout.number] = 1914 o->data.timeout.seconds; 1915 } 1916 o = o->next; 1917 free(p); 1918 } 1919 1920 /* 'flags S/SA' by default on stateful rules */ 1921 if (!r.action && !r.flags && !r.flagset && 1922 !$9.fragment && !($9.marker & FOM_FLAGS) && 1923 r.keep_state) { 1924 r.flags = parse_flags("S"); 1925 r.flagset = parse_flags("SA"); 1926 } 1927 if (!adaptive && r.max_states) { 1928 r.timeout[PFTM_ADAPTIVE_START] = 1929 (r.max_states / 10) * 6; 1930 r.timeout[PFTM_ADAPTIVE_END] = 1931 (r.max_states / 10) * 12; 1932 } 1933 if (r.rule_flag & PFRULE_SRCTRACK) { 1934 if (srctrack == PF_SRCTRACK_GLOBAL && 1935 r.max_src_nodes) { 1936 yyerror("'max-src-nodes' is " 1937 "incompatible with " 1938 "'source-track global'"); 1939 YYERROR; 1940 } 1941 if (srctrack == PF_SRCTRACK_GLOBAL && 1942 r.max_src_conn) { 1943 yyerror("'max-src-conn' is " 1944 "incompatible with " 1945 "'source-track global'"); 1946 YYERROR; 1947 } 1948 if (srctrack == PF_SRCTRACK_GLOBAL && 1949 r.max_src_conn_rate.seconds) { 1950 yyerror("'max-src-conn-rate' is " 1951 "incompatible with " 1952 "'source-track global'"); 1953 YYERROR; 1954 } 1955 if (r.timeout[PFTM_SRC_NODE] < 1956 r.max_src_conn_rate.seconds) 1957 r.timeout[PFTM_SRC_NODE] = 1958 r.max_src_conn_rate.seconds; 1959 r.rule_flag |= PFRULE_SRCTRACK; 1960 if (srctrack == PF_SRCTRACK_RULE) 1961 r.rule_flag |= PFRULE_RULESRCTRACK; 1962 } 1963 if (r.keep_state && !statelock) 1964 r.rule_flag |= default_statelock; 1965 1966 if ($9.fragment) 1967 r.rule_flag |= PFRULE_FRAGMENT; 1968 r.allow_opts = $9.allowopts; 1969 1970 decide_address_family($8.src.host, &r.af); 1971 decide_address_family($8.dst.host, &r.af); 1972 1973 if ($5.rt) { 1974 if (!r.direction) { 1975 yyerror("direction must be explicit " 1976 "with rules that specify routing"); 1977 YYERROR; 1978 } 1979 r.rt = $5.rt; 1980 r.rpool.opts = $5.pool_opts; 1981 if ($5.key != NULL) 1982 memcpy(&r.rpool.key, $5.key, 1983 sizeof(struct pf_poolhashkey)); 1984 } 1985 if (r.rt && r.rt != PF_FASTROUTE) { 1986 decide_address_family($5.host, &r.af); 1987 remove_invalid_hosts(&$5.host, &r.af); 1988 if ($5.host == NULL) { 1989 yyerror("no routing address with " 1990 "matching address family found."); 1991 YYERROR; 1992 } 1993 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1994 PF_POOL_NONE && ($5.host->next != NULL || 1995 $5.host->addr.type == PF_ADDR_TABLE || 1996 DYNIF_MULTIADDR($5.host->addr))) 1997 r.rpool.opts |= PF_POOL_ROUNDROBIN; 1998 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1999 PF_POOL_ROUNDROBIN && 2000 disallow_table($5.host, "tables are only " 2001 "supported in round-robin routing pools")) 2002 YYERROR; 2003 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2004 PF_POOL_ROUNDROBIN && 2005 disallow_alias($5.host, "interface (%s) " 2006 "is only supported in round-robin " 2007 "routing pools")) 2008 YYERROR; 2009 if ($5.host->next != NULL) { 2010 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2011 PF_POOL_ROUNDROBIN) { 2012 yyerror("r.rpool.opts must " 2013 "be PF_POOL_ROUNDROBIN"); 2014 YYERROR; 2015 } 2016 } 2017 } 2018 if ($9.queues.qname != NULL) { 2019 if (strlcpy(r.qname, $9.queues.qname, 2020 sizeof(r.qname)) >= sizeof(r.qname)) { 2021 yyerror("rule qname too long (max " 2022 "%d chars)", sizeof(r.qname)-1); 2023 YYERROR; 2024 } 2025 free($9.queues.qname); 2026 } 2027 if ($9.queues.pqname != NULL) { 2028 if (strlcpy(r.pqname, $9.queues.pqname, 2029 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2030 yyerror("rule pqname too long (max " 2031 "%d chars)", sizeof(r.pqname)-1); 2032 YYERROR; 2033 } 2034 free($9.queues.pqname); 2035 } 2036 2037 expand_rule(&r, $4, $5.host, $7, $8.src_os, 2038 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 2039 $9.uid, $9.gid, $9.icmpspec, ""); 2040 } 2041 ; 2042 2043filter_opts : { 2044 bzero(&filter_opts, sizeof filter_opts); 2045 filter_opts.rtableid = -1; 2046 } 2047 filter_opts_l 2048 { $$ = filter_opts; } 2049 | /* empty */ { 2050 bzero(&filter_opts, sizeof filter_opts); 2051 filter_opts.rtableid = -1; 2052 $$ = filter_opts; 2053 } 2054 ; 2055 2056filter_opts_l : filter_opts_l filter_opt 2057 | filter_opt 2058 ; 2059 2060filter_opt : USER uids { 2061 if (filter_opts.uid) 2062 $2->tail->next = filter_opts.uid; 2063 filter_opts.uid = $2; 2064 } 2065 | GROUP gids { 2066 if (filter_opts.gid) 2067 $2->tail->next = filter_opts.gid; 2068 filter_opts.gid = $2; 2069 } 2070 | flags { 2071 if (filter_opts.marker & FOM_FLAGS) { 2072 yyerror("flags cannot be redefined"); 2073 YYERROR; 2074 } 2075 filter_opts.marker |= FOM_FLAGS; 2076 filter_opts.flags.b1 |= $1.b1; 2077 filter_opts.flags.b2 |= $1.b2; 2078 filter_opts.flags.w |= $1.w; 2079 filter_opts.flags.w2 |= $1.w2; 2080 } 2081 | icmpspec { 2082 if (filter_opts.marker & FOM_ICMP) { 2083 yyerror("icmp-type cannot be redefined"); 2084 YYERROR; 2085 } 2086 filter_opts.marker |= FOM_ICMP; 2087 filter_opts.icmpspec = $1; 2088 } 2089 | tos { 2090 if (filter_opts.marker & FOM_TOS) { 2091 yyerror("tos cannot be redefined"); 2092 YYERROR; 2093 } 2094 filter_opts.marker |= FOM_TOS; 2095 filter_opts.tos = $1; 2096 } 2097 | keep { 2098 if (filter_opts.marker & FOM_KEEP) { 2099 yyerror("modulate or keep cannot be redefined"); 2100 YYERROR; 2101 } 2102 filter_opts.marker |= FOM_KEEP; 2103 filter_opts.keep.action = $1.action; 2104 filter_opts.keep.options = $1.options; 2105 } 2106 | FRAGMENT { 2107 filter_opts.fragment = 1; 2108 } 2109 | ALLOWOPTS { 2110 filter_opts.allowopts = 1; 2111 } 2112 | label { 2113 if (filter_opts.label) { 2114 yyerror("label cannot be redefined"); 2115 YYERROR; 2116 } 2117 filter_opts.label = $1; 2118 } 2119 | qname { 2120 if (filter_opts.queues.qname) { 2121 yyerror("queue cannot be redefined"); 2122 YYERROR; 2123 } 2124 filter_opts.queues = $1; 2125 } 2126 | TAG string { 2127 filter_opts.tag = $2; 2128 } 2129 | not TAGGED string { 2130 filter_opts.match_tag = $3; 2131 filter_opts.match_tag_not = $1; 2132 } 2133 | PROBABILITY STRING { 2134 char *e; 2135 double p = strtod($2, &e); 2136 2137 if (*e == '%') { 2138 p *= 0.01; 2139 e++; 2140 } 2141 if (*e) { 2142 yyerror("invalid probability: %s", $2); 2143 free($2); 2144 YYERROR; 2145 } 2146 p = floor(p * (UINT_MAX+1.0) + 0.5); 2147 if (p < 1.0 || p >= (UINT_MAX+1.0)) { 2148 yyerror("invalid probability: %s", $2); 2149 free($2); 2150 YYERROR; 2151 } 2152 filter_opts.prob = (u_int32_t)p; 2153 free($2); 2154 } 2155 | RTABLE number { 2156#ifdef __FreeBSD__ 2157 yyerror("rtable id not supported in FreeBSD, yet"); 2158 YYERROR; 2159#else 2160 if ($2 > RT_TABLEID_MAX || $2 < 0) { 2161 yyerror("invalid rtable id"); 2162 YYERROR; 2163 } 2164 filter_opts.rtableid = $2; 2165#endif 2166 } 2167 ; 2168 2169action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2170 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2171 ; 2172 2173blockspec : /* empty */ { 2174 $$.b2 = blockpolicy; 2175 $$.w = returnicmpdefault; 2176 $$.w2 = returnicmp6default; 2177 } 2178 | DROP { 2179 $$.b2 = PFRULE_DROP; 2180 $$.w = 0; 2181 $$.w2 = 0; 2182 } 2183 | RETURNRST { 2184 $$.b2 = PFRULE_RETURNRST; 2185 $$.w = 0; 2186 $$.w2 = 0; 2187 } 2188 | RETURNRST '(' TTL number ')' { 2189 if ($4 > 255) { 2190 yyerror("illegal ttl value %d", $4); 2191 YYERROR; 2192 } 2193 $$.b2 = PFRULE_RETURNRST; 2194 $$.w = $4; 2195 $$.w2 = 0; 2196 } 2197 | RETURNICMP { 2198 $$.b2 = PFRULE_RETURNICMP; 2199 $$.w = returnicmpdefault; 2200 $$.w2 = returnicmp6default; 2201 } 2202 | RETURNICMP6 { 2203 $$.b2 = PFRULE_RETURNICMP; 2204 $$.w = returnicmpdefault; 2205 $$.w2 = returnicmp6default; 2206 } 2207 | RETURNICMP '(' STRING ')' { 2208 $$.b2 = PFRULE_RETURNICMP; 2209 if (!($$.w = parseicmpspec($3, AF_INET))) { 2210 free($3); 2211 YYERROR; 2212 } 2213 free($3); 2214 $$.w2 = returnicmp6default; 2215 } 2216 | RETURNICMP6 '(' STRING ')' { 2217 $$.b2 = PFRULE_RETURNICMP; 2218 $$.w = returnicmpdefault; 2219 if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 2220 free($3); 2221 YYERROR; 2222 } 2223 free($3); 2224 } 2225 | RETURNICMP '(' STRING comma STRING ')' { 2226 $$.b2 = PFRULE_RETURNICMP; 2227 if (!($$.w = parseicmpspec($3, AF_INET)) || 2228 !($$.w2 = parseicmpspec($5, AF_INET6))) { 2229 free($3); 2230 free($5); 2231 YYERROR; 2232 } 2233 free($3); 2234 free($5); 2235 } 2236 | RETURN { 2237 $$.b2 = PFRULE_RETURN; 2238 $$.w = returnicmpdefault; 2239 $$.w2 = returnicmp6default; 2240 } 2241 ; 2242 2243dir : /* empty */ { $$ = 0; } 2244 | IN { $$ = PF_IN; } 2245 | OUT { $$ = PF_OUT; } 2246 ; 2247 2248quick : /* empty */ { $$.quick = 0; } 2249 | QUICK { $$.quick = 1; } 2250 ; 2251 2252logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2253 | log { $$ = $1; $$.quick = 0; } 2254 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2255 | log QUICK { $$ = $1; $$.quick = 1; } 2256 | QUICK log { $$ = $2; $$.quick = 1; } 2257 ; 2258 2259log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2260 | LOG '(' logopts ')' { 2261 $$.log = PF_LOG | $3.log; 2262 $$.logif = $3.logif; 2263 } 2264 ; 2265 2266logopts : logopt { $$ = $1; } 2267 | logopts comma logopt { 2268 $$.log = $1.log | $3.log; 2269 $$.logif = $3.logif; 2270 if ($$.logif == 0) 2271 $$.logif = $1.logif; 2272 } 2273 ; 2274 2275logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2276 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2277 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2278 | TO string { 2279 const char *errstr; 2280 u_int i; 2281 2282 $$.log = 0; 2283 if (strncmp($2, "pflog", 5)) { 2284 yyerror("%s: should be a pflog interface", $2); 2285 free($2); 2286 YYERROR; 2287 } 2288 i = strtonum($2 + 5, 0, 255, &errstr); 2289 if (errstr) { 2290 yyerror("%s: %s", $2, errstr); 2291 free($2); 2292 YYERROR; 2293 } 2294 free($2); 2295 $$.logif = i; 2296 } 2297 ; 2298 2299interface : /* empty */ { $$ = NULL; } 2300 | ON if_item_not { $$ = $2; } 2301 | ON '{' if_list '}' { $$ = $3; } 2302 ; 2303 2304if_list : if_item_not { $$ = $1; } 2305 | if_list comma if_item_not { 2306 $1->tail->next = $3; 2307 $1->tail = $3; 2308 $$ = $1; 2309 } 2310 ; 2311 2312if_item_not : not if_item { $$ = $2; $$->not = $1; } 2313 ; 2314 2315if_item : STRING { 2316 struct node_host *n; 2317 2318 $$ = calloc(1, sizeof(struct node_if)); 2319 if ($$ == NULL) 2320 err(1, "if_item: calloc"); 2321 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2322 sizeof($$->ifname)) { 2323 free($1); 2324 free($$); 2325 yyerror("interface name too long"); 2326 YYERROR; 2327 } 2328 2329 if ((n = ifa_exists($1)) != NULL) 2330 $$->ifa_flags = n->ifa_flags; 2331 2332 free($1); 2333 $$->not = 0; 2334 $$->next = NULL; 2335 $$->tail = $$; 2336 } 2337 ; 2338 2339af : /* empty */ { $$ = 0; } 2340 | INET { $$ = AF_INET; } 2341 | INET6 { $$ = AF_INET6; } 2342 ; 2343 2344proto : /* empty */ { $$ = NULL; } 2345 | PROTO proto_item { $$ = $2; } 2346 | PROTO '{' proto_list '}' { $$ = $3; } 2347 ; 2348 2349proto_list : proto_item { $$ = $1; } 2350 | proto_list comma proto_item { 2351 $1->tail->next = $3; 2352 $1->tail = $3; 2353 $$ = $1; 2354 } 2355 ; 2356 2357proto_item : STRING { 2358 u_int8_t pr; 2359 u_long ulval; 2360 2361 if (atoul($1, &ulval) == 0) { 2362 if (ulval > 255) { 2363 yyerror("protocol outside range"); 2364 free($1); 2365 YYERROR; 2366 } 2367 pr = (u_int8_t)ulval; 2368 } else { 2369 struct protoent *p; 2370 2371 p = getprotobyname($1); 2372 if (p == NULL) { 2373 yyerror("unknown protocol %s", $1); 2374 free($1); 2375 YYERROR; 2376 } 2377 pr = p->p_proto; 2378 } 2379 free($1); 2380 if (pr == 0) { 2381 yyerror("proto 0 cannot be used"); 2382 YYERROR; 2383 } 2384 $$ = calloc(1, sizeof(struct node_proto)); 2385 if ($$ == NULL) 2386 err(1, "proto_item: calloc"); 2387 $$->proto = pr; 2388 $$->next = NULL; 2389 $$->tail = $$; 2390 } 2391 ; 2392 2393fromto : ALL { 2394 $$.src.host = NULL; 2395 $$.src.port = NULL; 2396 $$.dst.host = NULL; 2397 $$.dst.port = NULL; 2398 $$.src_os = NULL; 2399 } 2400 | from os to { 2401 $$.src = $1; 2402 $$.src_os = $2; 2403 $$.dst = $3; 2404 } 2405 ; 2406 2407os : /* empty */ { $$ = NULL; } 2408 | OS xos { $$ = $2; } 2409 | OS '{' os_list '}' { $$ = $3; } 2410 ; 2411 2412xos : STRING { 2413 $$ = calloc(1, sizeof(struct node_os)); 2414 if ($$ == NULL) 2415 err(1, "os: calloc"); 2416 $$->os = $1; 2417 $$->tail = $$; 2418 } 2419 ; 2420 2421os_list : xos { $$ = $1; } 2422 | os_list comma xos { 2423 $1->tail->next = $3; 2424 $1->tail = $3; 2425 $$ = $1; 2426 } 2427 ; 2428 2429from : /* empty */ { 2430 $$.host = NULL; 2431 $$.port = NULL; 2432 } 2433 | FROM ipportspec { 2434 $$ = $2; 2435 } 2436 ; 2437 2438to : /* empty */ { 2439 $$.host = NULL; 2440 $$.port = NULL; 2441 } 2442 | TO ipportspec { 2443 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2444 "not permitted in a destination address")) 2445 YYERROR; 2446 $$ = $2; 2447 } 2448 ; 2449 2450ipportspec : ipspec { 2451 $$.host = $1; 2452 $$.port = NULL; 2453 } 2454 | ipspec PORT portspec { 2455 $$.host = $1; 2456 $$.port = $3; 2457 } 2458 | PORT portspec { 2459 $$.host = NULL; 2460 $$.port = $2; 2461 } 2462 ; 2463 2464ipspec : ANY { $$ = NULL; } 2465 | xhost { $$ = $1; } 2466 | '{' host_list '}' { $$ = $2; } 2467 ; 2468 2469host_list : ipspec { $$ = $1; } 2470 | host_list comma ipspec { 2471 if ($3 == NULL) 2472 $$ = $1; 2473 else if ($1 == NULL) 2474 $$ = $3; 2475 else { 2476 $1->tail->next = $3; 2477 $1->tail = $3->tail; 2478 $$ = $1; 2479 } 2480 } 2481 ; 2482 2483xhost : not host { 2484 struct node_host *n; 2485 2486 for (n = $2; n != NULL; n = n->next) 2487 n->not = $1; 2488 $$ = $2; 2489 } 2490 | not NOROUTE { 2491 $$ = calloc(1, sizeof(struct node_host)); 2492 if ($$ == NULL) 2493 err(1, "xhost: calloc"); 2494 $$->addr.type = PF_ADDR_NOROUTE; 2495 $$->next = NULL; 2496 $$->not = $1; 2497 $$->tail = $$; 2498 } 2499 | not URPFFAILED { 2500 $$ = calloc(1, sizeof(struct node_host)); 2501 if ($$ == NULL) 2502 err(1, "xhost: calloc"); 2503 $$->addr.type = PF_ADDR_URPFFAILED; 2504 $$->next = NULL; 2505 $$->not = $1; 2506 $$->tail = $$; 2507 } 2508 ; 2509 2510host : STRING { 2511 if (($$ = host($1)) == NULL) { 2512 /* error. "any" is handled elsewhere */ 2513 free($1); 2514 yyerror("could not parse host specification"); 2515 YYERROR; 2516 } 2517 free($1); 2518 2519 } 2520 | STRING '/' number { 2521 char *buf; 2522 2523 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2524 err(1, "host: asprintf"); 2525 free($1); 2526 if (($$ = host(buf)) == NULL) { 2527 /* error. "any" is handled elsewhere */ 2528 free(buf); 2529 yyerror("could not parse host specification"); 2530 YYERROR; 2531 } 2532 free(buf); 2533 } 2534 | dynaddr 2535 | dynaddr '/' number { 2536 struct node_host *n; 2537 2538 $$ = $1; 2539 for (n = $1; n != NULL; n = n->next) 2540 set_ipmask(n, $3); 2541 } 2542 | '<' STRING '>' { 2543 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2544 yyerror("table name '%s' too long", $2); 2545 free($2); 2546 YYERROR; 2547 } 2548 $$ = calloc(1, sizeof(struct node_host)); 2549 if ($$ == NULL) 2550 err(1, "host: calloc"); 2551 $$->addr.type = PF_ADDR_TABLE; 2552 if (strlcpy($$->addr.v.tblname, $2, 2553 sizeof($$->addr.v.tblname)) >= 2554 sizeof($$->addr.v.tblname)) 2555 errx(1, "host: strlcpy"); 2556 free($2); 2557 $$->next = NULL; 2558 $$->tail = $$; 2559 } 2560 | ROUTE STRING { 2561 $$ = calloc(1, sizeof(struct node_host)); 2562 if ($$ == NULL) { 2563 free($2); 2564 err(1, "host: calloc"); 2565 } 2566 $$->addr.type = PF_ADDR_RTLABEL; 2567 if (strlcpy($$->addr.v.rtlabelname, $2, 2568 sizeof($$->addr.v.rtlabelname)) >= 2569 sizeof($$->addr.v.rtlabelname)) { 2570 yyerror("route label too long, max %u chars", 2571 sizeof($$->addr.v.rtlabelname) - 1); 2572 free($2); 2573 free($$); 2574 YYERROR; 2575 } 2576 $$->next = NULL; 2577 $$->tail = $$; 2578 free($2); 2579 } 2580 ; 2581 2582number : STRING { 2583 u_long ulval; 2584 2585 if (atoul($1, &ulval) == -1) { 2586 yyerror("%s is not a number", $1); 2587 free($1); 2588 YYERROR; 2589 } else 2590 $$ = ulval; 2591 free($1); 2592 } 2593 ; 2594 2595dynaddr : '(' STRING ')' { 2596 int flags = 0; 2597 char *p, *op; 2598 2599 op = $2; 2600 if (!isalpha(op[0])) { 2601 yyerror("invalid interface name '%s'", op); 2602 free(op); 2603 YYERROR; 2604 } 2605 while ((p = strrchr($2, ':')) != NULL) { 2606 if (!strcmp(p+1, "network")) 2607 flags |= PFI_AFLAG_NETWORK; 2608 else if (!strcmp(p+1, "broadcast")) 2609 flags |= PFI_AFLAG_BROADCAST; 2610 else if (!strcmp(p+1, "peer")) 2611 flags |= PFI_AFLAG_PEER; 2612 else if (!strcmp(p+1, "0")) 2613 flags |= PFI_AFLAG_NOALIAS; 2614 else { 2615 yyerror("interface %s has bad modifier", 2616 $2); 2617 free(op); 2618 YYERROR; 2619 } 2620 *p = '\0'; 2621 } 2622 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2623 free(op); 2624 yyerror("illegal combination of " 2625 "interface modifiers"); 2626 YYERROR; 2627 } 2628 $$ = calloc(1, sizeof(struct node_host)); 2629 if ($$ == NULL) 2630 err(1, "address: calloc"); 2631 $$->af = 0; 2632 set_ipmask($$, 128); 2633 $$->addr.type = PF_ADDR_DYNIFTL; 2634 $$->addr.iflags = flags; 2635 if (strlcpy($$->addr.v.ifname, $2, 2636 sizeof($$->addr.v.ifname)) >= 2637 sizeof($$->addr.v.ifname)) { 2638 free(op); 2639 free($$); 2640 yyerror("interface name too long"); 2641 YYERROR; 2642 } 2643 free(op); 2644 $$->next = NULL; 2645 $$->tail = $$; 2646 } 2647 ; 2648 2649portspec : port_item { $$ = $1; } 2650 | '{' port_list '}' { $$ = $2; } 2651 ; 2652 2653port_list : port_item { $$ = $1; } 2654 | port_list comma port_item { 2655 $1->tail->next = $3; 2656 $1->tail = $3; 2657 $$ = $1; 2658 } 2659 ; 2660 2661port_item : port { 2662 $$ = calloc(1, sizeof(struct node_port)); 2663 if ($$ == NULL) 2664 err(1, "port_item: calloc"); 2665 $$->port[0] = $1.a; 2666 $$->port[1] = $1.b; 2667 if ($1.t) 2668 $$->op = PF_OP_RRG; 2669 else 2670 $$->op = PF_OP_EQ; 2671 $$->next = NULL; 2672 $$->tail = $$; 2673 } 2674 | unaryop port { 2675 if ($2.t) { 2676 yyerror("':' cannot be used with an other " 2677 "port operator"); 2678 YYERROR; 2679 } 2680 $$ = calloc(1, sizeof(struct node_port)); 2681 if ($$ == NULL) 2682 err(1, "port_item: calloc"); 2683 $$->port[0] = $2.a; 2684 $$->port[1] = $2.b; 2685 $$->op = $1; 2686 $$->next = NULL; 2687 $$->tail = $$; 2688 } 2689 | port PORTBINARY port { 2690 if ($1.t || $3.t) { 2691 yyerror("':' cannot be used with an other " 2692 "port operator"); 2693 YYERROR; 2694 } 2695 $$ = calloc(1, sizeof(struct node_port)); 2696 if ($$ == NULL) 2697 err(1, "port_item: calloc"); 2698 $$->port[0] = $1.a; 2699 $$->port[1] = $3.a; 2700 $$->op = $2; 2701 $$->next = NULL; 2702 $$->tail = $$; 2703 } 2704 ; 2705 2706port : STRING { 2707 char *p = strchr($1, ':'); 2708 2709 if (p == NULL) { 2710 if (($$.a = getservice($1)) == -1) { 2711 free($1); 2712 YYERROR; 2713 } 2714 $$.b = $$.t = 0; 2715 } else { 2716 int port[2]; 2717 2718 *p++ = 0; 2719 if ((port[0] = getservice($1)) == -1 || 2720 (port[1] = getservice(p)) == -1) { 2721 free($1); 2722 YYERROR; 2723 } 2724 $$.a = port[0]; 2725 $$.b = port[1]; 2726 $$.t = PF_OP_RRG; 2727 } 2728 free($1); 2729 } 2730 ; 2731 2732uids : uid_item { $$ = $1; } 2733 | '{' uid_list '}' { $$ = $2; } 2734 ; 2735 2736uid_list : uid_item { $$ = $1; } 2737 | uid_list comma uid_item { 2738 $1->tail->next = $3; 2739 $1->tail = $3; 2740 $$ = $1; 2741 } 2742 ; 2743 2744uid_item : uid { 2745 $$ = calloc(1, sizeof(struct node_uid)); 2746 if ($$ == NULL) 2747 err(1, "uid_item: calloc"); 2748 $$->uid[0] = $1; 2749 $$->uid[1] = $1; 2750 $$->op = PF_OP_EQ; 2751 $$->next = NULL; 2752 $$->tail = $$; 2753 } 2754 | unaryop uid { 2755 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2756 yyerror("user unknown requires operator = or " 2757 "!="); 2758 YYERROR; 2759 } 2760 $$ = calloc(1, sizeof(struct node_uid)); 2761 if ($$ == NULL) 2762 err(1, "uid_item: calloc"); 2763 $$->uid[0] = $2; 2764 $$->uid[1] = $2; 2765 $$->op = $1; 2766 $$->next = NULL; 2767 $$->tail = $$; 2768 } 2769 | uid PORTBINARY uid { 2770 if ($1 == UID_MAX || $3 == UID_MAX) { 2771 yyerror("user unknown requires operator = or " 2772 "!="); 2773 YYERROR; 2774 } 2775 $$ = calloc(1, sizeof(struct node_uid)); 2776 if ($$ == NULL) 2777 err(1, "uid_item: calloc"); 2778 $$->uid[0] = $1; 2779 $$->uid[1] = $3; 2780 $$->op = $2; 2781 $$->next = NULL; 2782 $$->tail = $$; 2783 } 2784 ; 2785 2786uid : STRING { 2787 u_long ulval; 2788 2789 if (atoul($1, &ulval) == -1) { 2790 if (!strcmp($1, "unknown")) 2791 $$ = UID_MAX; 2792 else { 2793 struct passwd *pw; 2794 2795 if ((pw = getpwnam($1)) == NULL) { 2796 yyerror("unknown user %s", $1); 2797 free($1); 2798 YYERROR; 2799 } 2800 $$ = pw->pw_uid; 2801 } 2802 } else { 2803 if (ulval >= UID_MAX) { 2804 free($1); 2805 yyerror("illegal uid value %lu", ulval); 2806 YYERROR; 2807 } 2808 $$ = ulval; 2809 } 2810 free($1); 2811 } 2812 ; 2813 2814gids : gid_item { $$ = $1; } 2815 | '{' gid_list '}' { $$ = $2; } 2816 ; 2817 2818gid_list : gid_item { $$ = $1; } 2819 | gid_list comma gid_item { 2820 $1->tail->next = $3; 2821 $1->tail = $3; 2822 $$ = $1; 2823 } 2824 ; 2825 2826gid_item : gid { 2827 $$ = calloc(1, sizeof(struct node_gid)); 2828 if ($$ == NULL) 2829 err(1, "gid_item: calloc"); 2830 $$->gid[0] = $1; 2831 $$->gid[1] = $1; 2832 $$->op = PF_OP_EQ; 2833 $$->next = NULL; 2834 $$->tail = $$; 2835 } 2836 | unaryop gid { 2837 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2838 yyerror("group unknown requires operator = or " 2839 "!="); 2840 YYERROR; 2841 } 2842 $$ = calloc(1, sizeof(struct node_gid)); 2843 if ($$ == NULL) 2844 err(1, "gid_item: calloc"); 2845 $$->gid[0] = $2; 2846 $$->gid[1] = $2; 2847 $$->op = $1; 2848 $$->next = NULL; 2849 $$->tail = $$; 2850 } 2851 | gid PORTBINARY gid { 2852 if ($1 == GID_MAX || $3 == GID_MAX) { 2853 yyerror("group unknown requires operator = or " 2854 "!="); 2855 YYERROR; 2856 } 2857 $$ = calloc(1, sizeof(struct node_gid)); 2858 if ($$ == NULL) 2859 err(1, "gid_item: calloc"); 2860 $$->gid[0] = $1; 2861 $$->gid[1] = $3; 2862 $$->op = $2; 2863 $$->next = NULL; 2864 $$->tail = $$; 2865 } 2866 ; 2867 2868gid : STRING { 2869 u_long ulval; 2870 2871 if (atoul($1, &ulval) == -1) { 2872 if (!strcmp($1, "unknown")) 2873 $$ = GID_MAX; 2874 else { 2875 struct group *grp; 2876 2877 if ((grp = getgrnam($1)) == NULL) { 2878 yyerror("unknown group %s", $1); 2879 free($1); 2880 YYERROR; 2881 } 2882 $$ = grp->gr_gid; 2883 } 2884 } else { 2885 if (ulval >= GID_MAX) { 2886 yyerror("illegal gid value %lu", ulval); 2887 free($1); 2888 YYERROR; 2889 } 2890 $$ = ulval; 2891 } 2892 free($1); 2893 } 2894 ; 2895 2896flag : STRING { 2897 int f; 2898 2899 if ((f = parse_flags($1)) < 0) { 2900 yyerror("bad flags %s", $1); 2901 free($1); 2902 YYERROR; 2903 } 2904 free($1); 2905 $$.b1 = f; 2906 } 2907 ; 2908 2909flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2910 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2911 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 2912 ; 2913 2914icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2915 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2916 | ICMP6TYPE icmp6_item { $$ = $2; } 2917 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2918 ; 2919 2920icmp_list : icmp_item { $$ = $1; } 2921 | icmp_list comma icmp_item { 2922 $1->tail->next = $3; 2923 $1->tail = $3; 2924 $$ = $1; 2925 } 2926 ; 2927 2928icmp6_list : icmp6_item { $$ = $1; } 2929 | icmp6_list comma icmp6_item { 2930 $1->tail->next = $3; 2931 $1->tail = $3; 2932 $$ = $1; 2933 } 2934 ; 2935 2936icmp_item : icmptype { 2937 $$ = calloc(1, sizeof(struct node_icmp)); 2938 if ($$ == NULL) 2939 err(1, "icmp_item: calloc"); 2940 $$->type = $1; 2941 $$->code = 0; 2942 $$->proto = IPPROTO_ICMP; 2943 $$->next = NULL; 2944 $$->tail = $$; 2945 } 2946 | icmptype CODE STRING { 2947 const struct icmpcodeent *p; 2948 u_long ulval; 2949 2950 if (atoul($3, &ulval) == 0) { 2951 if (ulval > 255) { 2952 free($3); 2953 yyerror("illegal icmp-code %lu", ulval); 2954 YYERROR; 2955 } 2956 } else { 2957 if ((p = geticmpcodebyname($1-1, $3, 2958 AF_INET)) == NULL) { 2959 yyerror("unknown icmp-code %s", $3); 2960 free($3); 2961 YYERROR; 2962 } 2963 ulval = p->code; 2964 } 2965 free($3); 2966 $$ = calloc(1, sizeof(struct node_icmp)); 2967 if ($$ == NULL) 2968 err(1, "icmp_item: calloc"); 2969 $$->type = $1; 2970 $$->code = ulval + 1; 2971 $$->proto = IPPROTO_ICMP; 2972 $$->next = NULL; 2973 $$->tail = $$; 2974 } 2975 ; 2976 2977icmp6_item : icmp6type { 2978 $$ = calloc(1, sizeof(struct node_icmp)); 2979 if ($$ == NULL) 2980 err(1, "icmp_item: calloc"); 2981 $$->type = $1; 2982 $$->code = 0; 2983 $$->proto = IPPROTO_ICMPV6; 2984 $$->next = NULL; 2985 $$->tail = $$; 2986 } 2987 | icmp6type CODE STRING { 2988 const struct icmpcodeent *p; 2989 u_long ulval; 2990 2991 if (atoul($3, &ulval) == 0) { 2992 if (ulval > 255) { 2993 yyerror("illegal icmp6-code %lu", 2994 ulval); 2995 free($3); 2996 YYERROR; 2997 } 2998 } else { 2999 if ((p = geticmpcodebyname($1-1, $3, 3000 AF_INET6)) == NULL) { 3001 yyerror("unknown icmp6-code %s", $3); 3002 free($3); 3003 YYERROR; 3004 } 3005 ulval = p->code; 3006 } 3007 free($3); 3008 $$ = calloc(1, sizeof(struct node_icmp)); 3009 if ($$ == NULL) 3010 err(1, "icmp_item: calloc"); 3011 $$->type = $1; 3012 $$->code = ulval + 1; 3013 $$->proto = IPPROTO_ICMPV6; 3014 $$->next = NULL; 3015 $$->tail = $$; 3016 } 3017 ; 3018 3019icmptype : STRING { 3020 const struct icmptypeent *p; 3021 u_long ulval; 3022 3023 if (atoul($1, &ulval) == 0) { 3024 if (ulval > 255) { 3025 yyerror("illegal icmp-type %lu", ulval); 3026 free($1); 3027 YYERROR; 3028 } 3029 $$ = ulval + 1; 3030 } else { 3031 if ((p = geticmptypebyname($1, AF_INET)) == 3032 NULL) { 3033 yyerror("unknown icmp-type %s", $1); 3034 free($1); 3035 YYERROR; 3036 } 3037 $$ = p->type + 1; 3038 } 3039 free($1); 3040 } 3041 ; 3042 3043icmp6type : STRING { 3044 const struct icmptypeent *p; 3045 u_long ulval; 3046 3047 if (atoul($1, &ulval) == 0) { 3048 if (ulval > 255) { 3049 yyerror("illegal icmp6-type %lu", 3050 ulval); 3051 free($1); 3052 YYERROR; 3053 } 3054 $$ = ulval + 1; 3055 } else { 3056 if ((p = geticmptypebyname($1, AF_INET6)) == 3057 NULL) { 3058 yyerror("unknown icmp6-type %s", $1); 3059 free($1); 3060 YYERROR; 3061 } 3062 $$ = p->type + 1; 3063 } 3064 free($1); 3065 } 3066 ; 3067 3068tos : TOS STRING { 3069 if (!strcmp($2, "lowdelay")) 3070 $$ = IPTOS_LOWDELAY; 3071 else if (!strcmp($2, "throughput")) 3072 $$ = IPTOS_THROUGHPUT; 3073 else if (!strcmp($2, "reliability")) 3074 $$ = IPTOS_RELIABILITY; 3075 else if ($2[0] == '0' && $2[1] == 'x') 3076 $$ = strtoul($2, NULL, 16); 3077 else 3078 $$ = strtoul($2, NULL, 10); 3079 if (!$$ || $$ > 255) { 3080 yyerror("illegal tos value %s", $2); 3081 free($2); 3082 YYERROR; 3083 } 3084 free($2); 3085 } 3086 ; 3087 3088sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3089 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3090 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3091 ; 3092 3093statelock : IFBOUND { 3094 $$ = PFRULE_IFBOUND; 3095 } 3096 | FLOATING { 3097 $$ = 0; 3098 } 3099 ; 3100 3101keep : NO STATE { 3102 $$.action = 0; 3103 $$.options = NULL; 3104 } 3105 | KEEP STATE state_opt_spec { 3106 $$.action = PF_STATE_NORMAL; 3107 $$.options = $3; 3108 } 3109 | MODULATE STATE state_opt_spec { 3110 $$.action = PF_STATE_MODULATE; 3111 $$.options = $3; 3112 } 3113 | SYNPROXY STATE state_opt_spec { 3114 $$.action = PF_STATE_SYNPROXY; 3115 $$.options = $3; 3116 } 3117 ; 3118 3119flush : /* empty */ { $$ = 0; } 3120 | FLUSH { $$ = PF_FLUSH; } 3121 | FLUSH GLOBAL { 3122 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3123 } 3124 ; 3125 3126state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3127 | /* empty */ { $$ = NULL; } 3128 ; 3129 3130state_opt_list : state_opt_item { $$ = $1; } 3131 | state_opt_list comma state_opt_item { 3132 $1->tail->next = $3; 3133 $1->tail = $3; 3134 $$ = $1; 3135 } 3136 ; 3137 3138state_opt_item : MAXIMUM number { 3139 $$ = calloc(1, sizeof(struct node_state_opt)); 3140 if ($$ == NULL) 3141 err(1, "state_opt_item: calloc"); 3142 $$->type = PF_STATE_OPT_MAX; 3143 $$->data.max_states = $2; 3144 $$->next = NULL; 3145 $$->tail = $$; 3146 } 3147 | NOSYNC { 3148 $$ = calloc(1, sizeof(struct node_state_opt)); 3149 if ($$ == NULL) 3150 err(1, "state_opt_item: calloc"); 3151 $$->type = PF_STATE_OPT_NOSYNC; 3152 $$->next = NULL; 3153 $$->tail = $$; 3154 } 3155 | MAXSRCSTATES number { 3156 $$ = calloc(1, sizeof(struct node_state_opt)); 3157 if ($$ == NULL) 3158 err(1, "state_opt_item: calloc"); 3159 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3160 $$->data.max_src_states = $2; 3161 $$->next = NULL; 3162 $$->tail = $$; 3163 } 3164 | MAXSRCCONN number { 3165 $$ = calloc(1, sizeof(struct node_state_opt)); 3166 if ($$ == NULL) 3167 err(1, "state_opt_item: calloc"); 3168 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3169 $$->data.max_src_conn = $2; 3170 $$->next = NULL; 3171 $$->tail = $$; 3172 } 3173 | MAXSRCCONNRATE number '/' number { 3174 $$ = calloc(1, sizeof(struct node_state_opt)); 3175 if ($$ == NULL) 3176 err(1, "state_opt_item: calloc"); 3177 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3178 $$->data.max_src_conn_rate.limit = $2; 3179 $$->data.max_src_conn_rate.seconds = $4; 3180 $$->next = NULL; 3181 $$->tail = $$; 3182 } 3183 | OVERLOAD '<' STRING '>' flush { 3184 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3185 yyerror("table name '%s' too long", $3); 3186 free($3); 3187 YYERROR; 3188 } 3189 $$ = calloc(1, sizeof(struct node_state_opt)); 3190 if ($$ == NULL) 3191 err(1, "state_opt_item: calloc"); 3192 if (strlcpy($$->data.overload.tblname, $3, 3193 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3194 errx(1, "state_opt_item: strlcpy"); 3195 free($3); 3196 $$->type = PF_STATE_OPT_OVERLOAD; 3197 $$->data.overload.flush = $5; 3198 $$->next = NULL; 3199 $$->tail = $$; 3200 } 3201 | MAXSRCNODES number { 3202 $$ = calloc(1, sizeof(struct node_state_opt)); 3203 if ($$ == NULL) 3204 err(1, "state_opt_item: calloc"); 3205 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3206 $$->data.max_src_nodes = $2; 3207 $$->next = NULL; 3208 $$->tail = $$; 3209 } 3210 | sourcetrack { 3211 $$ = calloc(1, sizeof(struct node_state_opt)); 3212 if ($$ == NULL) 3213 err(1, "state_opt_item: calloc"); 3214 $$->type = PF_STATE_OPT_SRCTRACK; 3215 $$->data.src_track = $1; 3216 $$->next = NULL; 3217 $$->tail = $$; 3218 } 3219 | statelock { 3220 $$ = calloc(1, sizeof(struct node_state_opt)); 3221 if ($$ == NULL) 3222 err(1, "state_opt_item: calloc"); 3223 $$->type = PF_STATE_OPT_STATELOCK; 3224 $$->data.statelock = $1; 3225 $$->next = NULL; 3226 $$->tail = $$; 3227 } 3228 | STRING number { 3229 int i; 3230 3231 for (i = 0; pf_timeouts[i].name && 3232 strcmp(pf_timeouts[i].name, $1); ++i) 3233 ; /* nothing */ 3234 if (!pf_timeouts[i].name) { 3235 yyerror("illegal timeout name %s", $1); 3236 free($1); 3237 YYERROR; 3238 } 3239 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3240 yyerror("illegal state timeout %s", $1); 3241 free($1); 3242 YYERROR; 3243 } 3244 free($1); 3245 $$ = calloc(1, sizeof(struct node_state_opt)); 3246 if ($$ == NULL) 3247 err(1, "state_opt_item: calloc"); 3248 $$->type = PF_STATE_OPT_TIMEOUT; 3249 $$->data.timeout.number = pf_timeouts[i].timeout; 3250 $$->data.timeout.seconds = $2; 3251 $$->next = NULL; 3252 $$->tail = $$; 3253 } 3254 ; 3255 3256label : LABEL STRING { 3257 $$ = $2; 3258 } 3259 ; 3260 3261qname : QUEUE STRING { 3262 $$.qname = $2; 3263 } 3264 | QUEUE '(' STRING ')' { 3265 $$.qname = $3; 3266 } 3267 | QUEUE '(' STRING comma STRING ')' { 3268 $$.qname = $3; 3269 $$.pqname = $5; 3270 } 3271 ; 3272 3273no : /* empty */ { $$ = 0; } 3274 | NO { $$ = 1; } 3275 ; 3276 3277rport : STRING { 3278 char *p = strchr($1, ':'); 3279 3280 if (p == NULL) { 3281 if (($$.a = getservice($1)) == -1) { 3282 free($1); 3283 YYERROR; 3284 } 3285 $$.b = $$.t = 0; 3286 } else if (!strcmp(p+1, "*")) { 3287 *p = 0; 3288 if (($$.a = getservice($1)) == -1) { 3289 free($1); 3290 YYERROR; 3291 } 3292 $$.b = 0; 3293 $$.t = 1; 3294 } else { 3295 *p++ = 0; 3296 if (($$.a = getservice($1)) == -1 || 3297 ($$.b = getservice(p)) == -1) { 3298 free($1); 3299 YYERROR; 3300 } 3301 if ($$.a == $$.b) 3302 $$.b = 0; 3303 $$.t = 0; 3304 } 3305 free($1); 3306 } 3307 ; 3308 3309redirspec : host { $$ = $1; } 3310 | '{' redir_host_list '}' { $$ = $2; } 3311 ; 3312 3313redir_host_list : host { $$ = $1; } 3314 | redir_host_list comma host { 3315 $1->tail->next = $3; 3316 $1->tail = $3->tail; 3317 $$ = $1; 3318 } 3319 ; 3320 3321redirpool : /* empty */ { $$ = NULL; } 3322 | ARROW redirspec { 3323 $$ = calloc(1, sizeof(struct redirection)); 3324 if ($$ == NULL) 3325 err(1, "redirection: calloc"); 3326 $$->host = $2; 3327 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3328 } 3329 | ARROW redirspec PORT rport { 3330 $$ = calloc(1, sizeof(struct redirection)); 3331 if ($$ == NULL) 3332 err(1, "redirection: calloc"); 3333 $$->host = $2; 3334 $$->rport = $4; 3335 } 3336 ; 3337 3338hashkey : /* empty */ 3339 { 3340 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3341 if ($$ == NULL) 3342 err(1, "hashkey: calloc"); 3343 $$->key32[0] = arc4random(); 3344 $$->key32[1] = arc4random(); 3345 $$->key32[2] = arc4random(); 3346 $$->key32[3] = arc4random(); 3347 } 3348 | string 3349 { 3350 if (!strncmp($1, "0x", 2)) { 3351 if (strlen($1) != 34) { 3352 free($1); 3353 yyerror("hex key must be 128 bits " 3354 "(32 hex digits) long"); 3355 YYERROR; 3356 } 3357 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3358 if ($$ == NULL) 3359 err(1, "hashkey: calloc"); 3360 3361 if (sscanf($1, "0x%8x%8x%8x%8x", 3362 &$$->key32[0], &$$->key32[1], 3363 &$$->key32[2], &$$->key32[3]) != 4) { 3364 free($$); 3365 free($1); 3366 yyerror("invalid hex key"); 3367 YYERROR; 3368 } 3369 } else { 3370 MD5_CTX context; 3371 3372 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3373 if ($$ == NULL) 3374 err(1, "hashkey: calloc"); 3375 MD5Init(&context); 3376 MD5Update(&context, (unsigned char *)$1, 3377 strlen($1)); 3378 MD5Final((unsigned char *)$$, &context); 3379 HTONL($$->key32[0]); 3380 HTONL($$->key32[1]); 3381 HTONL($$->key32[2]); 3382 HTONL($$->key32[3]); 3383 } 3384 free($1); 3385 } 3386 ; 3387 3388pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3389 pool_opts_l 3390 { $$ = pool_opts; } 3391 | /* empty */ { 3392 bzero(&pool_opts, sizeof pool_opts); 3393 $$ = pool_opts; 3394 } 3395 ; 3396 3397pool_opts_l : pool_opts_l pool_opt 3398 | pool_opt 3399 ; 3400 3401pool_opt : BITMASK { 3402 if (pool_opts.type) { 3403 yyerror("pool type cannot be redefined"); 3404 YYERROR; 3405 } 3406 pool_opts.type = PF_POOL_BITMASK; 3407 } 3408 | RANDOM { 3409 if (pool_opts.type) { 3410 yyerror("pool type cannot be redefined"); 3411 YYERROR; 3412 } 3413 pool_opts.type = PF_POOL_RANDOM; 3414 } 3415 | SOURCEHASH hashkey { 3416 if (pool_opts.type) { 3417 yyerror("pool type cannot be redefined"); 3418 YYERROR; 3419 } 3420 pool_opts.type = PF_POOL_SRCHASH; 3421 pool_opts.key = $2; 3422 } 3423 | ROUNDROBIN { 3424 if (pool_opts.type) { 3425 yyerror("pool type cannot be redefined"); 3426 YYERROR; 3427 } 3428 pool_opts.type = PF_POOL_ROUNDROBIN; 3429 } 3430 | STATICPORT { 3431 if (pool_opts.staticport) { 3432 yyerror("static-port cannot be redefined"); 3433 YYERROR; 3434 } 3435 pool_opts.staticport = 1; 3436 } 3437 | STICKYADDRESS { 3438 if (filter_opts.marker & POM_STICKYADDRESS) { 3439 yyerror("sticky-address cannot be redefined"); 3440 YYERROR; 3441 } 3442 pool_opts.marker |= POM_STICKYADDRESS; 3443 pool_opts.opts |= PF_POOL_STICKYADDR; 3444 } 3445 ; 3446 3447redirection : /* empty */ { $$ = NULL; } 3448 | ARROW host { 3449 $$ = calloc(1, sizeof(struct redirection)); 3450 if ($$ == NULL) 3451 err(1, "redirection: calloc"); 3452 $$->host = $2; 3453 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3454 } 3455 | ARROW host PORT rport { 3456 $$ = calloc(1, sizeof(struct redirection)); 3457 if ($$ == NULL) 3458 err(1, "redirection: calloc"); 3459 $$->host = $2; 3460 $$->rport = $4; 3461 } 3462 ; 3463 3464/* ifdef __FreeBSD__ */ 3465natpass : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 3466 | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 3467/* else 3468natpass : empty { $$.b1 = $$.b2 = 0; } 3469 | PASS { $$.b1 = 1; $$.b2 = 0; } 3470 * endif */ 3471 | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 3472 ; 3473 3474nataction : no NAT natpass { 3475 if ($1 && $3.b1) { 3476 yyerror("\"pass\" not valid with \"no\""); 3477 YYERROR; 3478 } 3479 if ($1) 3480 $$.b1 = PF_NONAT; 3481 else 3482 $$.b1 = PF_NAT; 3483 $$.b2 = $3.b1; 3484 $$.w = $3.b2; 3485 $$.w2 = $3.w2; 3486 } 3487 | no RDR natpass { 3488 if ($1 && $3.b1) { 3489 yyerror("\"pass\" not valid with \"no\""); 3490 YYERROR; 3491 } 3492 if ($1) 3493 $$.b1 = PF_NORDR; 3494 else 3495 $$.b1 = PF_RDR; 3496 $$.b2 = $3.b1; 3497 $$.w = $3.b2; 3498 $$.w2 = $3.w2; 3499 } 3500 ; 3501 3502natrule : nataction interface af proto fromto tag tagged rtable 3503 redirpool pool_opts 3504 { 3505 struct pf_rule r; 3506 3507 if (check_rulestate(PFCTL_STATE_NAT)) 3508 YYERROR; 3509 3510 memset(&r, 0, sizeof(r)); 3511 3512 r.action = $1.b1; 3513 r.natpass = $1.b2; 3514 r.log = $1.w; 3515 r.logif = $1.w2; 3516 r.af = $3; 3517 3518 if (!r.af) { 3519 if ($5.src.host && $5.src.host->af && 3520 !$5.src.host->ifindex) 3521 r.af = $5.src.host->af; 3522 else if ($5.dst.host && $5.dst.host->af && 3523 !$5.dst.host->ifindex) 3524 r.af = $5.dst.host->af; 3525 } 3526 3527 if ($6 != NULL) 3528 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3529 PF_TAG_NAME_SIZE) { 3530 yyerror("tag too long, max %u chars", 3531 PF_TAG_NAME_SIZE - 1); 3532 YYERROR; 3533 } 3534 3535 if ($7.name) 3536 if (strlcpy(r.match_tagname, $7.name, 3537 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3538 yyerror("tag too long, max %u chars", 3539 PF_TAG_NAME_SIZE - 1); 3540 YYERROR; 3541 } 3542 r.match_tag_not = $7.neg; 3543 r.rtableid = $8; 3544 3545 if (r.action == PF_NONAT || r.action == PF_NORDR) { 3546 if ($9 != NULL) { 3547 yyerror("translation rule with 'no' " 3548 "does not need '->'"); 3549 YYERROR; 3550 } 3551 } else { 3552 if ($9 == NULL || $9->host == NULL) { 3553 yyerror("translation rule requires '-> " 3554 "address'"); 3555 YYERROR; 3556 } 3557 if (!r.af && ! $9->host->ifindex) 3558 r.af = $9->host->af; 3559 3560 remove_invalid_hosts(&$9->host, &r.af); 3561 if (invalid_redirect($9->host, r.af)) 3562 YYERROR; 3563 if (check_netmask($9->host, r.af)) 3564 YYERROR; 3565 3566 r.rpool.proxy_port[0] = ntohs($9->rport.a); 3567 3568 switch (r.action) { 3569 case PF_RDR: 3570 if (!$9->rport.b && $9->rport.t && 3571 $5.dst.port != NULL) { 3572 r.rpool.proxy_port[1] = 3573 ntohs($9->rport.a) + 3574 (ntohs( 3575 $5.dst.port->port[1]) - 3576 ntohs( 3577 $5.dst.port->port[0])); 3578 } else 3579 r.rpool.proxy_port[1] = 3580 ntohs($9->rport.b); 3581 break; 3582 case PF_NAT: 3583 r.rpool.proxy_port[1] = 3584 ntohs($9->rport.b); 3585 if (!r.rpool.proxy_port[0] && 3586 !r.rpool.proxy_port[1]) { 3587 r.rpool.proxy_port[0] = 3588 PF_NAT_PROXY_PORT_LOW; 3589 r.rpool.proxy_port[1] = 3590 PF_NAT_PROXY_PORT_HIGH; 3591 } else if (!r.rpool.proxy_port[1]) 3592 r.rpool.proxy_port[1] = 3593 r.rpool.proxy_port[0]; 3594 break; 3595 default: 3596 break; 3597 } 3598 3599 r.rpool.opts = $10.type; 3600 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3601 PF_POOL_NONE && ($9->host->next != NULL || 3602 $9->host->addr.type == PF_ADDR_TABLE || 3603 DYNIF_MULTIADDR($9->host->addr))) 3604 r.rpool.opts = PF_POOL_ROUNDROBIN; 3605 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3606 PF_POOL_ROUNDROBIN && 3607 disallow_table($9->host, "tables are only " 3608 "supported in round-robin redirection " 3609 "pools")) 3610 YYERROR; 3611 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3612 PF_POOL_ROUNDROBIN && 3613 disallow_alias($9->host, "interface (%s) " 3614 "is only supported in round-robin " 3615 "redirection pools")) 3616 YYERROR; 3617 if ($9->host->next != NULL) { 3618 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3619 PF_POOL_ROUNDROBIN) { 3620 yyerror("only round-robin " 3621 "valid for multiple " 3622 "redirection addresses"); 3623 YYERROR; 3624 } 3625 } 3626 } 3627 3628 if ($10.key != NULL) 3629 memcpy(&r.rpool.key, $10.key, 3630 sizeof(struct pf_poolhashkey)); 3631 3632 if ($10.opts) 3633 r.rpool.opts |= $10.opts; 3634 3635 if ($10.staticport) { 3636 if (r.action != PF_NAT) { 3637 yyerror("the 'static-port' option is " 3638 "only valid with nat rules"); 3639 YYERROR; 3640 } 3641 if (r.rpool.proxy_port[0] != 3642 PF_NAT_PROXY_PORT_LOW && 3643 r.rpool.proxy_port[1] != 3644 PF_NAT_PROXY_PORT_HIGH) { 3645 yyerror("the 'static-port' option can't" 3646 " be used when specifying a port" 3647 " range"); 3648 YYERROR; 3649 } 3650 r.rpool.proxy_port[0] = 0; 3651 r.rpool.proxy_port[1] = 0; 3652 } 3653 3654 expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 3655 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3656 $5.dst.port, 0, 0, 0, ""); 3657 free($9); 3658 } 3659 ; 3660 3661binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag 3662 tagged rtable redirection 3663 { 3664 struct pf_rule binat; 3665 struct pf_pooladdr *pa; 3666 3667 if (check_rulestate(PFCTL_STATE_NAT)) 3668 YYERROR; 3669 if (disallow_urpf_failed($10, "\"urpf-failed\" is not " 3670 "permitted as a binat destination")) 3671 YYERROR; 3672 3673 memset(&binat, 0, sizeof(binat)); 3674 3675 if ($1 && $3.b1) { 3676 yyerror("\"pass\" not valid with \"no\""); 3677 YYERROR; 3678 } 3679 if ($1) 3680 binat.action = PF_NOBINAT; 3681 else 3682 binat.action = PF_BINAT; 3683 binat.natpass = $3.b1; 3684 binat.log = $3.b2; 3685 binat.logif = $3.w2; 3686 binat.af = $5; 3687 if (!binat.af && $8 != NULL && $8->af) 3688 binat.af = $8->af; 3689 if (!binat.af && $10 != NULL && $10->af) 3690 binat.af = $10->af; 3691 3692 if (!binat.af && $14 != NULL && $14->host) 3693 binat.af = $14->host->af; 3694 if (!binat.af) { 3695 yyerror("address family (inet/inet6) " 3696 "undefined"); 3697 YYERROR; 3698 } 3699 3700 if ($4 != NULL) { 3701 memcpy(binat.ifname, $4->ifname, 3702 sizeof(binat.ifname)); 3703 binat.ifnot = $4->not; 3704 free($4); 3705 } 3706 3707 if ($11 != NULL) 3708 if (strlcpy(binat.tagname, $11, 3709 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3710 yyerror("tag too long, max %u chars", 3711 PF_TAG_NAME_SIZE - 1); 3712 YYERROR; 3713 } 3714 if ($12.name) 3715 if (strlcpy(binat.match_tagname, $12.name, 3716 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3717 yyerror("tag too long, max %u chars", 3718 PF_TAG_NAME_SIZE - 1); 3719 YYERROR; 3720 } 3721 binat.match_tag_not = $12.neg; 3722 binat.rtableid = $13; 3723 3724 if ($6 != NULL) { 3725 binat.proto = $6->proto; 3726 free($6); 3727 } 3728 3729 if ($8 != NULL && disallow_table($8, "invalid use of " 3730 "table <%s> as the source address of a binat rule")) 3731 YYERROR; 3732 if ($8 != NULL && disallow_alias($8, "invalid use of " 3733 "interface (%s) as the source address of a binat " 3734 "rule")) 3735 YYERROR; 3736 if ($14 != NULL && $14->host != NULL && disallow_table( 3737 $14->host, "invalid use of table <%s> as the " 3738 "redirect address of a binat rule")) 3739 YYERROR; 3740 if ($14 != NULL && $14->host != NULL && disallow_alias( 3741 $14->host, "invalid use of interface (%s) as the " 3742 "redirect address of a binat rule")) 3743 YYERROR; 3744 3745 if ($8 != NULL) { 3746 if ($8->next) { 3747 yyerror("multiple binat ip addresses"); 3748 YYERROR; 3749 } 3750 if ($8->addr.type == PF_ADDR_DYNIFTL) 3751 $8->af = binat.af; 3752 if ($8->af != binat.af) { 3753 yyerror("binat ip versions must match"); 3754 YYERROR; 3755 } 3756 if (check_netmask($8, binat.af)) 3757 YYERROR; 3758 memcpy(&binat.src.addr, &$8->addr, 3759 sizeof(binat.src.addr)); 3760 free($8); 3761 } 3762 if ($10 != NULL) { 3763 if ($10->next) { 3764 yyerror("multiple binat ip addresses"); 3765 YYERROR; 3766 } 3767 if ($10->af != binat.af && $10->af) { 3768 yyerror("binat ip versions must match"); 3769 YYERROR; 3770 } 3771 if (check_netmask($10, binat.af)) 3772 YYERROR; 3773 memcpy(&binat.dst.addr, &$10->addr, 3774 sizeof(binat.dst.addr)); 3775 binat.dst.neg = $10->not; 3776 free($10); 3777 } 3778 3779 if (binat.action == PF_NOBINAT) { 3780 if ($14 != NULL) { 3781 yyerror("'no binat' rule does not need" 3782 " '->'"); 3783 YYERROR; 3784 } 3785 } else { 3786 if ($14 == NULL || $14->host == NULL) { 3787 yyerror("'binat' rule requires" 3788 " '-> address'"); 3789 YYERROR; 3790 } 3791 3792 remove_invalid_hosts(&$14->host, &binat.af); 3793 if (invalid_redirect($14->host, binat.af)) 3794 YYERROR; 3795 if ($14->host->next != NULL) { 3796 yyerror("binat rule must redirect to " 3797 "a single address"); 3798 YYERROR; 3799 } 3800 if (check_netmask($14->host, binat.af)) 3801 YYERROR; 3802 3803 if (!PF_AZERO(&binat.src.addr.v.a.mask, 3804 binat.af) && 3805 !PF_AEQ(&binat.src.addr.v.a.mask, 3806 &$14->host->addr.v.a.mask, binat.af)) { 3807 yyerror("'binat' source mask and " 3808 "redirect mask must be the same"); 3809 YYERROR; 3810 } 3811 3812 TAILQ_INIT(&binat.rpool.list); 3813 pa = calloc(1, sizeof(struct pf_pooladdr)); 3814 if (pa == NULL) 3815 err(1, "binat: calloc"); 3816 pa->addr = $14->host->addr; 3817 pa->ifname[0] = 0; 3818 TAILQ_INSERT_TAIL(&binat.rpool.list, 3819 pa, entries); 3820 3821 free($14); 3822 } 3823 3824 pfctl_add_rule(pf, &binat, ""); 3825 } 3826 ; 3827 3828tag : /* empty */ { $$ = NULL; } 3829 | TAG STRING { $$ = $2; } 3830 ; 3831 3832tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 3833 | not TAGGED string { $$.neg = $1; $$.name = $3; } 3834 ; 3835 3836rtable : /* empty */ { $$ = -1; } 3837 | RTABLE number { 3838#ifdef __FreeBSD__ 3839 yyerror("rtable id not supported in FreeBSD, yet"); 3840 YYERROR; 3841#else 3842 if ($2 > RT_TABLEID_MAX || $2 < 0) { 3843 yyerror("invalid rtable id"); 3844 YYERROR; 3845 } 3846 $$ = $2; 3847#endif 3848 } 3849 ; 3850 3851route_host : STRING { 3852 $$ = calloc(1, sizeof(struct node_host)); 3853 if ($$ == NULL) 3854 err(1, "route_host: calloc"); 3855 $$->ifname = $1; 3856 set_ipmask($$, 128); 3857 $$->next = NULL; 3858 $$->tail = $$; 3859 } 3860 | '(' STRING host ')' { 3861 $$ = $3; 3862 $$->ifname = $2; 3863 } 3864 ; 3865 3866route_host_list : route_host { $$ = $1; } 3867 | route_host_list comma route_host { 3868 if ($1->af == 0) 3869 $1->af = $3->af; 3870 if ($1->af != $3->af) { 3871 yyerror("all pool addresses must be in the " 3872 "same address family"); 3873 YYERROR; 3874 } 3875 $1->tail->next = $3; 3876 $1->tail = $3->tail; 3877 $$ = $1; 3878 } 3879 ; 3880 3881routespec : route_host { $$ = $1; } 3882 | '{' route_host_list '}' { $$ = $2; } 3883 ; 3884 3885route : /* empty */ { 3886 $$.host = NULL; 3887 $$.rt = 0; 3888 $$.pool_opts = 0; 3889 } 3890 | FASTROUTE { 3891 $$.host = NULL; 3892 $$.rt = PF_FASTROUTE; 3893 $$.pool_opts = 0; 3894 } 3895 | ROUTETO routespec pool_opts { 3896 $$.host = $2; 3897 $$.rt = PF_ROUTETO; 3898 $$.pool_opts = $3.type | $3.opts; 3899 if ($3.key != NULL) 3900 $$.key = $3.key; 3901 } 3902 | REPLYTO routespec pool_opts { 3903 $$.host = $2; 3904 $$.rt = PF_REPLYTO; 3905 $$.pool_opts = $3.type | $3.opts; 3906 if ($3.key != NULL) 3907 $$.key = $3.key; 3908 } 3909 | DUPTO routespec pool_opts { 3910 $$.host = $2; 3911 $$.rt = PF_DUPTO; 3912 $$.pool_opts = $3.type | $3.opts; 3913 if ($3.key != NULL) 3914 $$.key = $3.key; 3915 } 3916 ; 3917 3918timeout_spec : STRING number 3919 { 3920 if (check_rulestate(PFCTL_STATE_OPTION)) { 3921 free($1); 3922 YYERROR; 3923 } 3924 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3925 yyerror("unknown timeout %s", $1); 3926 free($1); 3927 YYERROR; 3928 } 3929 free($1); 3930 } 3931 ; 3932 3933timeout_list : timeout_list comma timeout_spec 3934 | timeout_spec 3935 ; 3936 3937limit_spec : STRING number 3938 { 3939 if (check_rulestate(PFCTL_STATE_OPTION)) { 3940 free($1); 3941 YYERROR; 3942 } 3943 if (pfctl_set_limit(pf, $1, $2) != 0) { 3944 yyerror("unable to set limit %s %u", $1, $2); 3945 free($1); 3946 YYERROR; 3947 } 3948 free($1); 3949 } 3950 ; 3951 3952limit_list : limit_list comma limit_spec 3953 | limit_spec 3954 ; 3955 3956comma : ',' 3957 | /* empty */ 3958 ; 3959 3960yesno : NO { $$ = 0; } 3961 | STRING { 3962 if (!strcmp($1, "yes")) 3963 $$ = 1; 3964 else { 3965 yyerror("invalid value '%s', expected 'yes' " 3966 "or 'no'", $1); 3967 free($1); 3968 YYERROR; 3969 } 3970 free($1); 3971 } 3972 ; 3973 3974unaryop : '=' { $$ = PF_OP_EQ; } 3975 | '!' '=' { $$ = PF_OP_NE; } 3976 | '<' '=' { $$ = PF_OP_LE; } 3977 | '<' { $$ = PF_OP_LT; } 3978 | '>' '=' { $$ = PF_OP_GE; } 3979 | '>' { $$ = PF_OP_GT; } 3980 ; 3981 3982%% 3983 3984int 3985yyerror(const char *fmt, ...) 3986{ 3987 va_list ap; 3988 extern char *infile; 3989 3990 errors = 1; 3991 va_start(ap, fmt); 3992 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3993 vfprintf(stderr, fmt, ap); 3994 fprintf(stderr, "\n"); 3995 va_end(ap); 3996 return (0); 3997} 3998 3999int 4000disallow_table(struct node_host *h, const char *fmt) 4001{ 4002 for (; h != NULL; h = h->next) 4003 if (h->addr.type == PF_ADDR_TABLE) { 4004 yyerror(fmt, h->addr.v.tblname); 4005 return (1); 4006 } 4007 return (0); 4008} 4009 4010int 4011disallow_urpf_failed(struct node_host *h, const char *fmt) 4012{ 4013 for (; h != NULL; h = h->next) 4014 if (h->addr.type == PF_ADDR_URPFFAILED) { 4015 yyerror(fmt); 4016 return (1); 4017 } 4018 return (0); 4019} 4020 4021int 4022disallow_alias(struct node_host *h, const char *fmt) 4023{ 4024 for (; h != NULL; h = h->next) 4025 if (DYNIF_MULTIADDR(h->addr)) { 4026 yyerror(fmt, h->addr.v.tblname); 4027 return (1); 4028 } 4029 return (0); 4030} 4031 4032int 4033rule_consistent(struct pf_rule *r, int anchor_call) 4034{ 4035 int problems = 0; 4036 4037 switch (r->action) { 4038 case PF_PASS: 4039 case PF_DROP: 4040 case PF_SCRUB: 4041 case PF_NOSCRUB: 4042 problems = filter_consistent(r, anchor_call); 4043 break; 4044 case PF_NAT: 4045 case PF_NONAT: 4046 problems = nat_consistent(r); 4047 break; 4048 case PF_RDR: 4049 case PF_NORDR: 4050 problems = rdr_consistent(r); 4051 break; 4052 case PF_BINAT: 4053 case PF_NOBINAT: 4054 default: 4055 break; 4056 } 4057 return (problems); 4058} 4059 4060int 4061filter_consistent(struct pf_rule *r, int anchor_call) 4062{ 4063 int problems = 0; 4064 4065 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 4066 (r->src.port_op || r->dst.port_op)) { 4067 yyerror("port only applies to tcp/udp"); 4068 problems++; 4069 } 4070 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 4071 (r->type || r->code)) { 4072 yyerror("icmp-type/code only applies to icmp"); 4073 problems++; 4074 } 4075 if (!r->af && (r->type || r->code)) { 4076 yyerror("must indicate address family with icmp-type/code"); 4077 problems++; 4078 } 4079 if (r->overload_tblname[0] && 4080 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 4081 yyerror("'overload' requires 'max-src-conn' " 4082 "or 'max-src-conn-rate'"); 4083 problems++; 4084 } 4085 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 4086 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 4087 yyerror("proto %s doesn't match address family %s", 4088 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 4089 r->af == AF_INET ? "inet" : "inet6"); 4090 problems++; 4091 } 4092 if (r->allow_opts && r->action != PF_PASS) { 4093 yyerror("allow-opts can only be specified for pass rules"); 4094 problems++; 4095 } 4096 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 4097 r->dst.port_op || r->flagset || r->type || r->code)) { 4098 yyerror("fragments can be filtered only on IP header fields"); 4099 problems++; 4100 } 4101 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 4102 yyerror("return-rst can only be applied to TCP rules"); 4103 problems++; 4104 } 4105 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 4106 yyerror("max-src-nodes requires 'source-track rule'"); 4107 problems++; 4108 } 4109 if (r->action == PF_DROP && r->keep_state) { 4110 yyerror("keep state on block rules doesn't make sense"); 4111 problems++; 4112 } 4113 return (-problems); 4114} 4115 4116int 4117nat_consistent(struct pf_rule *r) 4118{ 4119 return (0); /* yeah! */ 4120} 4121 4122int 4123rdr_consistent(struct pf_rule *r) 4124{ 4125 int problems = 0; 4126 4127 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 4128 if (r->src.port_op) { 4129 yyerror("src port only applies to tcp/udp"); 4130 problems++; 4131 } 4132 if (r->dst.port_op) { 4133 yyerror("dst port only applies to tcp/udp"); 4134 problems++; 4135 } 4136 if (r->rpool.proxy_port[0]) { 4137 yyerror("rpool port only applies to tcp/udp"); 4138 problems++; 4139 } 4140 } 4141 if (r->dst.port_op && 4142 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 4143 yyerror("invalid port operator for rdr destination port"); 4144 problems++; 4145 } 4146 return (-problems); 4147} 4148 4149int 4150process_tabledef(char *name, struct table_opts *opts) 4151{ 4152 struct pfr_buffer ab; 4153 struct node_tinit *ti; 4154 4155 bzero(&ab, sizeof(ab)); 4156 ab.pfrb_type = PFRB_ADDRS; 4157 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4158 if (ti->file) 4159 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 4160 if (errno) 4161 yyerror("cannot load \"%s\": %s", 4162 ti->file, strerror(errno)); 4163 else 4164 yyerror("file \"%s\" contains bad data", 4165 ti->file); 4166 goto _error; 4167 } 4168 if (ti->host) 4169 if (append_addr_host(&ab, ti->host, 0, 0)) { 4170 yyerror("cannot create address buffer: %s", 4171 strerror(errno)); 4172 goto _error; 4173 } 4174 } 4175 if (pf->opts & PF_OPT_VERBOSE) 4176 print_tabledef(name, opts->flags, opts->init_addr, 4177 &opts->init_nodes); 4178 if (!(pf->opts & PF_OPT_NOACTION) && 4179 pfctl_define_table(name, opts->flags, opts->init_addr, 4180 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4181 yyerror("cannot define table %s: %s", name, 4182 pfr_strerror(errno)); 4183 goto _error; 4184 } 4185 pf->tdirty = 1; 4186 pfr_buf_clear(&ab); 4187 return (0); 4188_error: 4189 pfr_buf_clear(&ab); 4190 return (-1); 4191} 4192 4193struct keywords { 4194 const char *k_name; 4195 int k_val; 4196}; 4197 4198/* macro gore, but you should've seen the prior indentation nightmare... */ 4199 4200#define FREE_LIST(T,r) \ 4201 do { \ 4202 T *p, *node = r; \ 4203 while (node != NULL) { \ 4204 p = node; \ 4205 node = node->next; \ 4206 free(p); \ 4207 } \ 4208 } while (0) 4209 4210#define LOOP_THROUGH(T,n,r,C) \ 4211 do { \ 4212 T *n; \ 4213 if (r == NULL) { \ 4214 r = calloc(1, sizeof(T)); \ 4215 if (r == NULL) \ 4216 err(1, "LOOP: calloc"); \ 4217 r->next = NULL; \ 4218 } \ 4219 n = r; \ 4220 while (n != NULL) { \ 4221 do { \ 4222 C; \ 4223 } while (0); \ 4224 n = n->next; \ 4225 } \ 4226 } while (0) 4227 4228void 4229expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4230{ 4231 char *tmp; 4232 char *p, *q; 4233 4234 if ((tmp = calloc(1, len)) == NULL) 4235 err(1, "expand_label_str: calloc"); 4236 p = q = label; 4237 while ((q = strstr(p, srch)) != NULL) { 4238 *q = '\0'; 4239 if ((strlcat(tmp, p, len) >= len) || 4240 (strlcat(tmp, repl, len) >= len)) 4241 errx(1, "expand_label: label too long"); 4242 q += strlen(srch); 4243 p = q; 4244 } 4245 if (strlcat(tmp, p, len) >= len) 4246 errx(1, "expand_label: label too long"); 4247 strlcpy(label, tmp, len); /* always fits */ 4248 free(tmp); 4249} 4250 4251void 4252expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4253{ 4254 if (strstr(label, name) != NULL) { 4255 if (!*ifname) 4256 expand_label_str(label, len, name, "any"); 4257 else 4258 expand_label_str(label, len, name, ifname); 4259 } 4260} 4261 4262void 4263expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4264 struct node_host *h) 4265{ 4266 char tmp[64], tmp_not[66]; 4267 4268 if (strstr(label, name) != NULL) { 4269 switch (h->addr.type) { 4270 case PF_ADDR_DYNIFTL: 4271 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4272 break; 4273 case PF_ADDR_TABLE: 4274 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4275 break; 4276 case PF_ADDR_NOROUTE: 4277 snprintf(tmp, sizeof(tmp), "no-route"); 4278 break; 4279 case PF_ADDR_URPFFAILED: 4280 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4281 break; 4282 case PF_ADDR_ADDRMASK: 4283 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4284 PF_AZERO(&h->addr.v.a.mask, af))) 4285 snprintf(tmp, sizeof(tmp), "any"); 4286 else { 4287 char a[48]; 4288 int bits; 4289 4290 if (inet_ntop(af, &h->addr.v.a.addr, a, 4291 sizeof(a)) == NULL) 4292 snprintf(tmp, sizeof(tmp), "?"); 4293 else { 4294 bits = unmask(&h->addr.v.a.mask, af); 4295 if ((af == AF_INET && bits < 32) || 4296 (af == AF_INET6 && bits < 128)) 4297 snprintf(tmp, sizeof(tmp), 4298 "%s/%d", a, bits); 4299 else 4300 snprintf(tmp, sizeof(tmp), 4301 "%s", a); 4302 } 4303 } 4304 break; 4305 default: 4306 snprintf(tmp, sizeof(tmp), "?"); 4307 break; 4308 } 4309 4310 if (h->not) { 4311 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4312 expand_label_str(label, len, name, tmp_not); 4313 } else 4314 expand_label_str(label, len, name, tmp); 4315 } 4316} 4317 4318void 4319expand_label_port(const char *name, char *label, size_t len, 4320 struct node_port *port) 4321{ 4322 char a1[6], a2[6], op[13] = ""; 4323 4324 if (strstr(label, name) != NULL) { 4325 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4326 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4327 if (!port->op) 4328 ; 4329 else if (port->op == PF_OP_IRG) 4330 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4331 else if (port->op == PF_OP_XRG) 4332 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4333 else if (port->op == PF_OP_EQ) 4334 snprintf(op, sizeof(op), "%s", a1); 4335 else if (port->op == PF_OP_NE) 4336 snprintf(op, sizeof(op), "!=%s", a1); 4337 else if (port->op == PF_OP_LT) 4338 snprintf(op, sizeof(op), "<%s", a1); 4339 else if (port->op == PF_OP_LE) 4340 snprintf(op, sizeof(op), "<=%s", a1); 4341 else if (port->op == PF_OP_GT) 4342 snprintf(op, sizeof(op), ">%s", a1); 4343 else if (port->op == PF_OP_GE) 4344 snprintf(op, sizeof(op), ">=%s", a1); 4345 expand_label_str(label, len, name, op); 4346 } 4347} 4348 4349void 4350expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4351{ 4352 struct protoent *pe; 4353 char n[4]; 4354 4355 if (strstr(label, name) != NULL) { 4356 pe = getprotobynumber(proto); 4357 if (pe != NULL) 4358 expand_label_str(label, len, name, pe->p_name); 4359 else { 4360 snprintf(n, sizeof(n), "%u", proto); 4361 expand_label_str(label, len, name, n); 4362 } 4363 } 4364} 4365 4366void 4367expand_label_nr(const char *name, char *label, size_t len) 4368{ 4369 char n[11]; 4370 4371 if (strstr(label, name) != NULL) { 4372 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4373 expand_label_str(label, len, name, n); 4374 } 4375} 4376 4377void 4378expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4379 struct node_host *src_host, struct node_port *src_port, 4380 struct node_host *dst_host, struct node_port *dst_port, 4381 u_int8_t proto) 4382{ 4383 expand_label_if("$if", label, len, ifname); 4384 expand_label_addr("$srcaddr", label, len, af, src_host); 4385 expand_label_addr("$dstaddr", label, len, af, dst_host); 4386 expand_label_port("$srcport", label, len, src_port); 4387 expand_label_port("$dstport", label, len, dst_port); 4388 expand_label_proto("$proto", label, len, proto); 4389 expand_label_nr("$nr", label, len); 4390} 4391 4392int 4393expand_altq(struct pf_altq *a, struct node_if *interfaces, 4394 struct node_queue *nqueues, struct node_queue_bw bwspec, 4395 struct node_queue_opt *opts) 4396{ 4397 struct pf_altq pa, pb; 4398 char qname[PF_QNAME_SIZE]; 4399 struct node_queue *n; 4400 struct node_queue_bw bw; 4401 int errs = 0; 4402 4403 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4404 FREE_LIST(struct node_if, interfaces); 4405 FREE_LIST(struct node_queue, nqueues); 4406 return (0); 4407 } 4408 4409 LOOP_THROUGH(struct node_if, interface, interfaces, 4410 memcpy(&pa, a, sizeof(struct pf_altq)); 4411 if (strlcpy(pa.ifname, interface->ifname, 4412 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4413 errx(1, "expand_altq: strlcpy"); 4414 4415 if (interface->not) { 4416 yyerror("altq on ! <interface> is not supported"); 4417 errs++; 4418 } else { 4419 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4420 errs++; 4421 else 4422 if (pfctl_add_altq(pf, &pa)) 4423 errs++; 4424 4425 if (pf->opts & PF_OPT_VERBOSE) { 4426 print_altq(&pf->paltq->altq, 0, 4427 &bwspec, opts); 4428 if (nqueues && nqueues->tail) { 4429 printf("queue { "); 4430 LOOP_THROUGH(struct node_queue, queue, 4431 nqueues, 4432 printf("%s ", 4433 queue->queue); 4434 ); 4435 printf("}"); 4436 } 4437 printf("\n"); 4438 } 4439 4440 if (pa.scheduler == ALTQT_CBQ || 4441 pa.scheduler == ALTQT_HFSC) { 4442 /* now create a root queue */ 4443 memset(&pb, 0, sizeof(struct pf_altq)); 4444 if (strlcpy(qname, "root_", sizeof(qname)) >= 4445 sizeof(qname)) 4446 errx(1, "expand_altq: strlcpy"); 4447 if (strlcat(qname, interface->ifname, 4448 sizeof(qname)) >= sizeof(qname)) 4449 errx(1, "expand_altq: strlcat"); 4450 if (strlcpy(pb.qname, qname, 4451 sizeof(pb.qname)) >= sizeof(pb.qname)) 4452 errx(1, "expand_altq: strlcpy"); 4453 if (strlcpy(pb.ifname, interface->ifname, 4454 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4455 errx(1, "expand_altq: strlcpy"); 4456 pb.qlimit = pa.qlimit; 4457 pb.scheduler = pa.scheduler; 4458 bw.bw_absolute = pa.ifbandwidth; 4459 bw.bw_percent = 0; 4460 if (eval_pfqueue(pf, &pb, &bw, opts)) 4461 errs++; 4462 else 4463 if (pfctl_add_altq(pf, &pb)) 4464 errs++; 4465 } 4466 4467 LOOP_THROUGH(struct node_queue, queue, nqueues, 4468 n = calloc(1, sizeof(struct node_queue)); 4469 if (n == NULL) 4470 err(1, "expand_altq: calloc"); 4471 if (pa.scheduler == ALTQT_CBQ || 4472 pa.scheduler == ALTQT_HFSC) 4473 if (strlcpy(n->parent, qname, 4474 sizeof(n->parent)) >= 4475 sizeof(n->parent)) 4476 errx(1, "expand_altq: strlcpy"); 4477 if (strlcpy(n->queue, queue->queue, 4478 sizeof(n->queue)) >= sizeof(n->queue)) 4479 errx(1, "expand_altq: strlcpy"); 4480 if (strlcpy(n->ifname, interface->ifname, 4481 sizeof(n->ifname)) >= sizeof(n->ifname)) 4482 errx(1, "expand_altq: strlcpy"); 4483 n->scheduler = pa.scheduler; 4484 n->next = NULL; 4485 n->tail = n; 4486 if (queues == NULL) 4487 queues = n; 4488 else { 4489 queues->tail->next = n; 4490 queues->tail = n; 4491 } 4492 ); 4493 } 4494 ); 4495 FREE_LIST(struct node_if, interfaces); 4496 FREE_LIST(struct node_queue, nqueues); 4497 4498 return (errs); 4499} 4500 4501int 4502expand_queue(struct pf_altq *a, struct node_if *interfaces, 4503 struct node_queue *nqueues, struct node_queue_bw bwspec, 4504 struct node_queue_opt *opts) 4505{ 4506 struct node_queue *n, *nq; 4507 struct pf_altq pa; 4508 u_int8_t found = 0; 4509 u_int8_t errs = 0; 4510 4511 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4512 FREE_LIST(struct node_queue, nqueues); 4513 return (0); 4514 } 4515 4516 if (queues == NULL) { 4517 yyerror("queue %s has no parent", a->qname); 4518 FREE_LIST(struct node_queue, nqueues); 4519 return (1); 4520 } 4521 4522 LOOP_THROUGH(struct node_if, interface, interfaces, 4523 LOOP_THROUGH(struct node_queue, tqueue, queues, 4524 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4525 (interface->ifname[0] == 0 || 4526 (!interface->not && !strncmp(interface->ifname, 4527 tqueue->ifname, IFNAMSIZ)) || 4528 (interface->not && strncmp(interface->ifname, 4529 tqueue->ifname, IFNAMSIZ)))) { 4530 /* found ourself in queues */ 4531 found++; 4532 4533 memcpy(&pa, a, sizeof(struct pf_altq)); 4534 4535 if (pa.scheduler != ALTQT_NONE && 4536 pa.scheduler != tqueue->scheduler) { 4537 yyerror("exactly one scheduler type " 4538 "per interface allowed"); 4539 return (1); 4540 } 4541 pa.scheduler = tqueue->scheduler; 4542 4543 /* scheduler dependent error checking */ 4544 switch (pa.scheduler) { 4545 case ALTQT_PRIQ: 4546 if (nqueues != NULL) { 4547 yyerror("priq queues cannot " 4548 "have child queues"); 4549 return (1); 4550 } 4551 if (bwspec.bw_absolute > 0 || 4552 bwspec.bw_percent < 100) { 4553 yyerror("priq doesn't take " 4554 "bandwidth"); 4555 return (1); 4556 } 4557 break; 4558 default: 4559 break; 4560 } 4561 4562 if (strlcpy(pa.ifname, tqueue->ifname, 4563 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4564 errx(1, "expand_queue: strlcpy"); 4565 if (strlcpy(pa.parent, tqueue->parent, 4566 sizeof(pa.parent)) >= sizeof(pa.parent)) 4567 errx(1, "expand_queue: strlcpy"); 4568 4569 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4570 errs++; 4571 else 4572 if (pfctl_add_altq(pf, &pa)) 4573 errs++; 4574 4575 for (nq = nqueues; nq != NULL; nq = nq->next) { 4576 if (!strcmp(a->qname, nq->queue)) { 4577 yyerror("queue cannot have " 4578 "itself as child"); 4579 errs++; 4580 continue; 4581 } 4582 n = calloc(1, 4583 sizeof(struct node_queue)); 4584 if (n == NULL) 4585 err(1, "expand_queue: calloc"); 4586 if (strlcpy(n->parent, a->qname, 4587 sizeof(n->parent)) >= 4588 sizeof(n->parent)) 4589 errx(1, "expand_queue strlcpy"); 4590 if (strlcpy(n->queue, nq->queue, 4591 sizeof(n->queue)) >= 4592 sizeof(n->queue)) 4593 errx(1, "expand_queue strlcpy"); 4594 if (strlcpy(n->ifname, tqueue->ifname, 4595 sizeof(n->ifname)) >= 4596 sizeof(n->ifname)) 4597 errx(1, "expand_queue strlcpy"); 4598 n->scheduler = tqueue->scheduler; 4599 n->next = NULL; 4600 n->tail = n; 4601 if (queues == NULL) 4602 queues = n; 4603 else { 4604 queues->tail->next = n; 4605 queues->tail = n; 4606 } 4607 } 4608 if ((pf->opts & PF_OPT_VERBOSE) && ( 4609 (found == 1 && interface->ifname[0] == 0) || 4610 (found > 0 && interface->ifname[0] != 0))) { 4611 print_queue(&pf->paltq->altq, 0, 4612 &bwspec, interface->ifname[0] != 0, 4613 opts); 4614 if (nqueues && nqueues->tail) { 4615 printf("{ "); 4616 LOOP_THROUGH(struct node_queue, 4617 queue, nqueues, 4618 printf("%s ", 4619 queue->queue); 4620 ); 4621 printf("}"); 4622 } 4623 printf("\n"); 4624 } 4625 } 4626 ); 4627 ); 4628 4629 FREE_LIST(struct node_queue, nqueues); 4630 FREE_LIST(struct node_if, interfaces); 4631 4632 if (!found) { 4633 yyerror("queue %s has no parent", a->qname); 4634 errs++; 4635 } 4636 4637 if (errs) 4638 return (1); 4639 else 4640 return (0); 4641} 4642 4643void 4644expand_rule(struct pf_rule *r, 4645 struct node_if *interfaces, struct node_host *rpool_hosts, 4646 struct node_proto *protos, struct node_os *src_oses, 4647 struct node_host *src_hosts, struct node_port *src_ports, 4648 struct node_host *dst_hosts, struct node_port *dst_ports, 4649 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4650 const char *anchor_call) 4651{ 4652 sa_family_t af = r->af; 4653 int added = 0, error = 0; 4654 char ifname[IF_NAMESIZE]; 4655 char label[PF_RULE_LABEL_SIZE]; 4656 char tagname[PF_TAG_NAME_SIZE]; 4657 char match_tagname[PF_TAG_NAME_SIZE]; 4658 struct pf_pooladdr *pa; 4659 struct node_host *h; 4660 u_int8_t flags, flagset, keep_state; 4661 4662 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4663 errx(1, "expand_rule: strlcpy"); 4664 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4665 errx(1, "expand_rule: strlcpy"); 4666 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4667 sizeof(match_tagname)) 4668 errx(1, "expand_rule: strlcpy"); 4669 flags = r->flags; 4670 flagset = r->flagset; 4671 keep_state = r->keep_state; 4672 4673 LOOP_THROUGH(struct node_if, interface, interfaces, 4674 LOOP_THROUGH(struct node_proto, proto, protos, 4675 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4676 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4677 LOOP_THROUGH(struct node_port, src_port, src_ports, 4678 LOOP_THROUGH(struct node_os, src_os, src_oses, 4679 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4680 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4681 LOOP_THROUGH(struct node_uid, uid, uids, 4682 LOOP_THROUGH(struct node_gid, gid, gids, 4683 4684 r->af = af; 4685 /* for link-local IPv6 address, interface must match up */ 4686 if ((r->af && src_host->af && r->af != src_host->af) || 4687 (r->af && dst_host->af && r->af != dst_host->af) || 4688 (src_host->af && dst_host->af && 4689 src_host->af != dst_host->af) || 4690 (src_host->ifindex && dst_host->ifindex && 4691 src_host->ifindex != dst_host->ifindex) || 4692 (src_host->ifindex && *interface->ifname && 4693 src_host->ifindex != if_nametoindex(interface->ifname)) || 4694 (dst_host->ifindex && *interface->ifname && 4695 dst_host->ifindex != if_nametoindex(interface->ifname))) 4696 continue; 4697 if (!r->af && src_host->af) 4698 r->af = src_host->af; 4699 else if (!r->af && dst_host->af) 4700 r->af = dst_host->af; 4701 4702 if (*interface->ifname) 4703 strlcpy(r->ifname, interface->ifname, 4704 sizeof(r->ifname)); 4705 else if (if_indextoname(src_host->ifindex, ifname)) 4706 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4707 else if (if_indextoname(dst_host->ifindex, ifname)) 4708 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4709 else 4710 memset(r->ifname, '\0', sizeof(r->ifname)); 4711 4712 if (strlcpy(r->label, label, sizeof(r->label)) >= 4713 sizeof(r->label)) 4714 errx(1, "expand_rule: strlcpy"); 4715 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4716 sizeof(r->tagname)) 4717 errx(1, "expand_rule: strlcpy"); 4718 if (strlcpy(r->match_tagname, match_tagname, 4719 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4720 errx(1, "expand_rule: strlcpy"); 4721 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4722 src_host, src_port, dst_host, dst_port, proto->proto); 4723 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4724 src_host, src_port, dst_host, dst_port, proto->proto); 4725 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4726 r->af, src_host, src_port, dst_host, dst_port, 4727 proto->proto); 4728 4729 error += check_netmask(src_host, r->af); 4730 error += check_netmask(dst_host, r->af); 4731 4732 r->ifnot = interface->not; 4733 r->proto = proto->proto; 4734 r->src.addr = src_host->addr; 4735 r->src.neg = src_host->not; 4736 r->src.port[0] = src_port->port[0]; 4737 r->src.port[1] = src_port->port[1]; 4738 r->src.port_op = src_port->op; 4739 r->dst.addr = dst_host->addr; 4740 r->dst.neg = dst_host->not; 4741 r->dst.port[0] = dst_port->port[0]; 4742 r->dst.port[1] = dst_port->port[1]; 4743 r->dst.port_op = dst_port->op; 4744 r->uid.op = uid->op; 4745 r->uid.uid[0] = uid->uid[0]; 4746 r->uid.uid[1] = uid->uid[1]; 4747 r->gid.op = gid->op; 4748 r->gid.gid[0] = gid->gid[0]; 4749 r->gid.gid[1] = gid->gid[1]; 4750 r->type = icmp_type->type; 4751 r->code = icmp_type->code; 4752 4753 if ((keep_state == PF_STATE_MODULATE || 4754 keep_state == PF_STATE_SYNPROXY) && 4755 r->proto && r->proto != IPPROTO_TCP) 4756 r->keep_state = PF_STATE_NORMAL; 4757 else 4758 r->keep_state = keep_state; 4759 4760 if (r->proto && r->proto != IPPROTO_TCP) { 4761 r->flags = 0; 4762 r->flagset = 0; 4763 } else { 4764 r->flags = flags; 4765 r->flagset = flagset; 4766 } 4767 if (icmp_type->proto && r->proto != icmp_type->proto) { 4768 yyerror("icmp-type mismatch"); 4769 error++; 4770 } 4771 4772 if (src_os && src_os->os) { 4773 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4774 if ((pf->opts & PF_OPT_VERBOSE2) && 4775 r->os_fingerprint == PF_OSFP_NOMATCH) 4776 fprintf(stderr, 4777 "warning: unknown '%s' OS fingerprint\n", 4778 src_os->os); 4779 } else { 4780 r->os_fingerprint = PF_OSFP_ANY; 4781 } 4782 4783 TAILQ_INIT(&r->rpool.list); 4784 for (h = rpool_hosts; h != NULL; h = h->next) { 4785 pa = calloc(1, sizeof(struct pf_pooladdr)); 4786 if (pa == NULL) 4787 err(1, "expand_rule: calloc"); 4788 pa->addr = h->addr; 4789 if (h->ifname != NULL) { 4790 if (strlcpy(pa->ifname, h->ifname, 4791 sizeof(pa->ifname)) >= 4792 sizeof(pa->ifname)) 4793 errx(1, "expand_rule: strlcpy"); 4794 } else 4795 pa->ifname[0] = 0; 4796 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4797 } 4798 4799 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4800 yyerror("skipping rule due to errors"); 4801 else { 4802 r->nr = pf->astack[pf->asd]->match++; 4803 pfctl_add_rule(pf, r, anchor_call); 4804 added++; 4805 } 4806 4807 )))))))))); 4808 4809 FREE_LIST(struct node_if, interfaces); 4810 FREE_LIST(struct node_proto, protos); 4811 FREE_LIST(struct node_host, src_hosts); 4812 FREE_LIST(struct node_port, src_ports); 4813 FREE_LIST(struct node_os, src_oses); 4814 FREE_LIST(struct node_host, dst_hosts); 4815 FREE_LIST(struct node_port, dst_ports); 4816 FREE_LIST(struct node_uid, uids); 4817 FREE_LIST(struct node_gid, gids); 4818 FREE_LIST(struct node_icmp, icmp_types); 4819 FREE_LIST(struct node_host, rpool_hosts); 4820 4821 if (!added) 4822 yyerror("rule expands to no valid combination"); 4823} 4824 4825int 4826expand_skip_interface(struct node_if *interfaces) 4827{ 4828 int errs = 0; 4829 4830 if (!interfaces || (!interfaces->next && !interfaces->not && 4831 !strcmp(interfaces->ifname, "none"))) { 4832 if (pf->opts & PF_OPT_VERBOSE) 4833 printf("set skip on none\n"); 4834 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4835 return (errs); 4836 } 4837 4838 if (pf->opts & PF_OPT_VERBOSE) 4839 printf("set skip on {"); 4840 LOOP_THROUGH(struct node_if, interface, interfaces, 4841 if (pf->opts & PF_OPT_VERBOSE) 4842 printf(" %s", interface->ifname); 4843 if (interface->not) { 4844 yyerror("skip on ! <interface> is not supported"); 4845 errs++; 4846 } else 4847 errs += pfctl_set_interface_flags(pf, 4848 interface->ifname, PFI_IFLAG_SKIP, 1); 4849 ); 4850 if (pf->opts & PF_OPT_VERBOSE) 4851 printf(" }\n"); 4852 4853 FREE_LIST(struct node_if, interfaces); 4854 4855 if (errs) 4856 return (1); 4857 else 4858 return (0); 4859} 4860 4861#undef FREE_LIST 4862#undef LOOP_THROUGH 4863 4864int 4865check_rulestate(int desired_state) 4866{ 4867 if (require_order && (rulestate > desired_state)) { 4868 yyerror("Rules must be in order: options, normalization, " 4869 "queueing, translation, filtering"); 4870 return (1); 4871 } 4872 rulestate = desired_state; 4873 return (0); 4874} 4875 4876int 4877kw_cmp(const void *k, const void *e) 4878{ 4879 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4880} 4881 4882int 4883lookup(char *s) 4884{ 4885 /* this has to be sorted always */ 4886 static const struct keywords keywords[] = { 4887 { "all", ALL}, 4888 { "allow-opts", ALLOWOPTS}, 4889 { "altq", ALTQ}, 4890 { "anchor", ANCHOR}, 4891 { "antispoof", ANTISPOOF}, 4892 { "any", ANY}, 4893 { "bandwidth", BANDWIDTH}, 4894 { "binat", BINAT}, 4895 { "binat-anchor", BINATANCHOR}, 4896 { "bitmask", BITMASK}, 4897 { "block", BLOCK}, 4898 { "block-policy", BLOCKPOLICY}, 4899 { "cbq", CBQ}, 4900 { "code", CODE}, 4901 { "crop", FRAGCROP}, 4902 { "debug", DEBUG}, 4903 { "drop", DROP}, 4904 { "drop-ovl", FRAGDROP}, 4905 { "dup-to", DUPTO}, 4906 { "fastroute", FASTROUTE}, 4907 { "file", FILENAME}, 4908 { "fingerprints", FINGERPRINTS}, 4909 { "flags", FLAGS}, 4910 { "floating", FLOATING}, 4911 { "flush", FLUSH}, 4912 { "for", FOR}, 4913 { "fragment", FRAGMENT}, 4914 { "from", FROM}, 4915 { "global", GLOBAL}, 4916 { "group", GROUP}, 4917 { "hfsc", HFSC}, 4918 { "hostid", HOSTID}, 4919 { "icmp-type", ICMPTYPE}, 4920 { "icmp6-type", ICMP6TYPE}, 4921 { "if-bound", IFBOUND}, 4922 { "in", IN}, 4923 { "inet", INET}, 4924 { "inet6", INET6}, 4925 { "keep", KEEP}, 4926 { "label", LABEL}, 4927 { "limit", LIMIT}, 4928 { "linkshare", LINKSHARE}, 4929 { "load", LOAD}, 4930 { "log", LOG}, 4931 { "loginterface", LOGINTERFACE}, 4932 { "max", MAXIMUM}, 4933 { "max-mss", MAXMSS}, 4934 { "max-src-conn", MAXSRCCONN}, 4935 { "max-src-conn-rate", MAXSRCCONNRATE}, 4936 { "max-src-nodes", MAXSRCNODES}, 4937 { "max-src-states", MAXSRCSTATES}, 4938 { "min-ttl", MINTTL}, 4939 { "modulate", MODULATE}, 4940 { "nat", NAT}, 4941 { "nat-anchor", NATANCHOR}, 4942 { "no", NO}, 4943 { "no-df", NODF}, 4944 { "no-route", NOROUTE}, 4945 { "no-sync", NOSYNC}, 4946 { "on", ON}, 4947 { "optimization", OPTIMIZATION}, 4948 { "os", OS}, 4949 { "out", OUT}, 4950 { "overload", OVERLOAD}, 4951 { "pass", PASS}, 4952 { "port", PORT}, 4953 { "priority", PRIORITY}, 4954 { "priq", PRIQ}, 4955 { "probability", PROBABILITY}, 4956 { "proto", PROTO}, 4957 { "qlimit", QLIMIT}, 4958 { "queue", QUEUE}, 4959 { "quick", QUICK}, 4960 { "random", RANDOM}, 4961 { "random-id", RANDOMID}, 4962 { "rdr", RDR}, 4963 { "rdr-anchor", RDRANCHOR}, 4964 { "realtime", REALTIME}, 4965 { "reassemble", REASSEMBLE}, 4966 { "reply-to", REPLYTO}, 4967 { "require-order", REQUIREORDER}, 4968 { "return", RETURN}, 4969 { "return-icmp", RETURNICMP}, 4970 { "return-icmp6", RETURNICMP6}, 4971 { "return-rst", RETURNRST}, 4972 { "round-robin", ROUNDROBIN}, 4973 { "route", ROUTE}, 4974 { "route-to", ROUTETO}, 4975 { "rtable", RTABLE}, 4976 { "rule", RULE}, 4977 { "ruleset-optimization", RULESET_OPTIMIZATION}, 4978 { "scrub", SCRUB}, 4979 { "set", SET}, 4980 { "skip", SKIP}, 4981 { "source-hash", SOURCEHASH}, 4982 { "source-track", SOURCETRACK}, 4983 { "state", STATE}, 4984 { "state-policy", STATEPOLICY}, 4985 { "static-port", STATICPORT}, 4986 { "sticky-address", STICKYADDRESS}, 4987 { "synproxy", SYNPROXY}, 4988 { "table", TABLE}, 4989 { "tag", TAG}, 4990 { "tagged", TAGGED}, 4991 { "tbrsize", TBRSIZE}, 4992 { "timeout", TIMEOUT}, 4993 { "to", TO}, 4994 { "tos", TOS}, 4995 { "ttl", TTL}, 4996 { "upperlimit", UPPERLIMIT}, 4997 { "urpf-failed", URPFFAILED}, 4998 { "user", USER}, 4999 }; 5000 const struct keywords *p; 5001 5002 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5003 sizeof(keywords[0]), kw_cmp); 5004 5005 if (p) { 5006 if (debug > 1) 5007 fprintf(stderr, "%s: %d\n", s, p->k_val); 5008 return (p->k_val); 5009 } else { 5010 if (debug > 1) 5011 fprintf(stderr, "string: %s\n", s); 5012 return (STRING); 5013 } 5014} 5015 5016#define MAXPUSHBACK 128 5017 5018char *parsebuf; 5019int parseindex; 5020char pushback_buffer[MAXPUSHBACK]; 5021int pushback_index = 0; 5022 5023int 5024lgetc(FILE *f) 5025{ 5026 int c, next; 5027 5028 if (parsebuf) { 5029 /* Read character from the parsebuffer instead of input. */ 5030 if (parseindex >= 0) { 5031 c = parsebuf[parseindex++]; 5032 if (c != '\0') 5033 return (c); 5034 parsebuf = NULL; 5035 } else 5036 parseindex++; 5037 } 5038 5039 if (pushback_index) 5040 return (pushback_buffer[--pushback_index]); 5041 5042 while ((c = getc(f)) == '\\') { 5043 next = getc(f); 5044 if (next != '\n') { 5045 c = next; 5046 break; 5047 } 5048 yylval.lineno = lineno; 5049 lineno++; 5050 } 5051 if (c == '\t' || c == ' ') { 5052 /* Compress blanks to a single space. */ 5053 do { 5054 c = getc(f); 5055 } while (c == '\t' || c == ' '); 5056 ungetc(c, f); 5057 c = ' '; 5058 } 5059 5060 return (c); 5061} 5062 5063int 5064lungetc(int c) 5065{ 5066 if (c == EOF) 5067 return (EOF); 5068 if (parsebuf) { 5069 parseindex--; 5070 if (parseindex >= 0) 5071 return (c); 5072 } 5073 if (pushback_index < MAXPUSHBACK-1) 5074 return (pushback_buffer[pushback_index++] = c); 5075 else 5076 return (EOF); 5077} 5078 5079int 5080findeol(void) 5081{ 5082 int c; 5083 5084 parsebuf = NULL; 5085 pushback_index = 0; 5086 5087 /* skip to either EOF or the first real EOL */ 5088 while (1) { 5089 c = lgetc(fin); 5090 if (c == '\n') { 5091 lineno++; 5092 break; 5093 } 5094 if (c == EOF) 5095 break; 5096 } 5097 return (ERROR); 5098} 5099 5100int 5101yylex(void) 5102{ 5103 char buf[8096]; 5104 char *p, *val; 5105 int endc, c, next; 5106 int token; 5107 5108top: 5109 p = buf; 5110 while ((c = lgetc(fin)) == ' ') 5111 ; /* nothing */ 5112 5113 yylval.lineno = lineno; 5114 if (c == '#') 5115 while ((c = lgetc(fin)) != '\n' && c != EOF) 5116 ; /* nothing */ 5117 if (c == '$' && parsebuf == NULL) { 5118 while (1) { 5119 if ((c = lgetc(fin)) == EOF) 5120 return (0); 5121 5122 if (p + 1 >= buf + sizeof(buf) - 1) { 5123 yyerror("string too long"); 5124 return (findeol()); 5125 } 5126 if (isalnum(c) || c == '_') { 5127 *p++ = (char)c; 5128 continue; 5129 } 5130 *p = '\0'; 5131 lungetc(c); 5132 break; 5133 } 5134 val = symget(buf); 5135 if (val == NULL) { 5136 yyerror("macro '%s' not defined", buf); 5137 return (findeol()); 5138 } 5139 parsebuf = val; 5140 parseindex = 0; 5141 goto top; 5142 } 5143 5144 switch (c) { 5145 case '\'': 5146 case '"': 5147 endc = c; 5148 while (1) { 5149 if ((c = lgetc(fin)) == EOF) 5150 return (0); 5151 if (c == endc) { 5152 *p = '\0'; 5153 break; 5154 } 5155 if (c == '\n') { 5156 lineno++; 5157 continue; 5158 } 5159 if (p + 1 >= buf + sizeof(buf) - 1) { 5160 yyerror("string too long"); 5161 return (findeol()); 5162 } 5163 *p++ = (char)c; 5164 } 5165 yylval.v.string = strdup(buf); 5166 if (yylval.v.string == NULL) 5167 err(1, "yylex: strdup"); 5168 return (STRING); 5169 case '<': 5170 next = lgetc(fin); 5171 if (next == '>') { 5172 yylval.v.i = PF_OP_XRG; 5173 return (PORTBINARY); 5174 } 5175 lungetc(next); 5176 break; 5177 case '>': 5178 next = lgetc(fin); 5179 if (next == '<') { 5180 yylval.v.i = PF_OP_IRG; 5181 return (PORTBINARY); 5182 } 5183 lungetc(next); 5184 break; 5185 case '-': 5186 next = lgetc(fin); 5187 if (next == '>') 5188 return (ARROW); 5189 lungetc(next); 5190 break; 5191 } 5192 5193#define allowed_in_string(x) \ 5194 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5195 x != '{' && x != '}' && x != '<' && x != '>' && \ 5196 x != '!' && x != '=' && x != '/' && x != '#' && \ 5197 x != ',')) 5198 5199 if (isalnum(c) || c == ':' || c == '_') { 5200 do { 5201 *p++ = c; 5202 if ((unsigned)(p-buf) >= sizeof(buf)) { 5203 yyerror("string too long"); 5204 return (findeol()); 5205 } 5206 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 5207 lungetc(c); 5208 *p = '\0'; 5209 if ((token = lookup(buf)) == STRING) 5210 if ((yylval.v.string = strdup(buf)) == NULL) 5211 err(1, "yylex: strdup"); 5212 return (token); 5213 } 5214 if (c == '\n') { 5215 yylval.lineno = lineno; 5216 lineno++; 5217 } 5218 if (c == EOF) 5219 return (0); 5220 return (c); 5221} 5222 5223int 5224parse_rules(FILE *input, struct pfctl *xpf) 5225{ 5226 struct sym *sym, *next; 5227 5228 fin = input; 5229 pf = xpf; 5230 lineno = 1; 5231 errors = 0; 5232 rulestate = PFCTL_STATE_NONE; 5233 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5234 returnicmp6default = 5235 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5236 blockpolicy = PFRULE_DROP; 5237 require_order = 1; 5238 5239 yyparse(); 5240 5241 /* Free macros and check which have not been used. */ 5242 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 5243 next = TAILQ_NEXT(sym, entries); 5244 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5245 fprintf(stderr, "warning: macro '%s' not " 5246 "used\n", sym->nam); 5247 free(sym->nam); 5248 free(sym->val); 5249 TAILQ_REMOVE(&symhead, sym, entries); 5250 free(sym); 5251 } 5252 5253 return (errors ? -1 : 0); 5254} 5255 5256/* 5257 * Over-designed efficiency is a French and German concept, so how about 5258 * we wait until they discover this ugliness and make it all fancy. 5259 */ 5260int 5261symset(const char *nam, const char *val, int persist) 5262{ 5263 struct sym *sym; 5264 5265 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5266 sym = TAILQ_NEXT(sym, entries)) 5267 ; /* nothing */ 5268 5269 if (sym != NULL) { 5270 if (sym->persist == 1) 5271 return (0); 5272 else { 5273 free(sym->nam); 5274 free(sym->val); 5275 TAILQ_REMOVE(&symhead, sym, entries); 5276 free(sym); 5277 } 5278 } 5279 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5280 return (-1); 5281 5282 sym->nam = strdup(nam); 5283 if (sym->nam == NULL) { 5284 free(sym); 5285 return (-1); 5286 } 5287 sym->val = strdup(val); 5288 if (sym->val == NULL) { 5289 free(sym->nam); 5290 free(sym); 5291 return (-1); 5292 } 5293 sym->used = 0; 5294 sym->persist = persist; 5295 TAILQ_INSERT_TAIL(&symhead, sym, entries); 5296 return (0); 5297} 5298 5299int 5300pfctl_cmdline_symset(char *s) 5301{ 5302 char *sym, *val; 5303 int ret; 5304 5305 if ((val = strrchr(s, '=')) == NULL) 5306 return (-1); 5307 5308 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5309 err(1, "pfctl_cmdline_symset: malloc"); 5310 5311 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5312 5313 ret = symset(sym, val + 1, 1); 5314 free(sym); 5315 5316 return (ret); 5317} 5318 5319char * 5320symget(const char *nam) 5321{ 5322 struct sym *sym; 5323 5324 TAILQ_FOREACH(sym, &symhead, entries) 5325 if (strcmp(nam, sym->nam) == 0) { 5326 sym->used = 1; 5327 return (sym->val); 5328 } 5329 return (NULL); 5330} 5331 5332void 5333mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5334{ 5335 int i; 5336 struct pf_rule *r; 5337 5338 for (i = 0; i < PF_RULESET_MAX; ++i) { 5339 while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 5340 != NULL) { 5341 TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 5342 TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 5343 dst->anchor->match++; 5344 } 5345 src->anchor->match = 0; 5346 while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 5347 != NULL) { 5348 TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 5349 TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 5350 r, entries); 5351 } 5352 } 5353} 5354 5355void 5356decide_address_family(struct node_host *n, sa_family_t *af) 5357{ 5358 if (*af != 0 || n == NULL) 5359 return; 5360 *af = n->af; 5361 while ((n = n->next) != NULL) { 5362 if (n->af != *af) { 5363 *af = 0; 5364 return; 5365 } 5366 } 5367} 5368 5369void 5370remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5371{ 5372 struct node_host *n = *nh, *prev = NULL; 5373 5374 while (n != NULL) { 5375 if (*af && n->af && n->af != *af) { 5376 /* unlink and free n */ 5377 struct node_host *next = n->next; 5378 5379 /* adjust tail pointer */ 5380 if (n == (*nh)->tail) 5381 (*nh)->tail = prev; 5382 /* adjust previous node's next pointer */ 5383 if (prev == NULL) 5384 *nh = next; 5385 else 5386 prev->next = next; 5387 /* free node */ 5388 if (n->ifname != NULL) 5389 free(n->ifname); 5390 free(n); 5391 n = next; 5392 } else { 5393 if (n->af && !*af) 5394 *af = n->af; 5395 prev = n; 5396 n = n->next; 5397 } 5398 } 5399} 5400 5401int 5402invalid_redirect(struct node_host *nh, sa_family_t af) 5403{ 5404 if (!af) { 5405 struct node_host *n; 5406 5407 /* tables and dyniftl are ok without an address family */ 5408 for (n = nh; n != NULL; n = n->next) { 5409 if (n->addr.type != PF_ADDR_TABLE && 5410 n->addr.type != PF_ADDR_DYNIFTL) { 5411 yyerror("address family not given and " 5412 "translation address expands to multiple " 5413 "address families"); 5414 return (1); 5415 } 5416 } 5417 } 5418 if (nh == NULL) { 5419 yyerror("no translation address with matching address family " 5420 "found."); 5421 return (1); 5422 } 5423 return (0); 5424} 5425 5426int 5427atoul(char *s, u_long *ulvalp) 5428{ 5429 u_long ulval; 5430 char *ep; 5431 5432 errno = 0; 5433 ulval = strtoul(s, &ep, 0); 5434 if (s[0] == '\0' || *ep != '\0') 5435 return (-1); 5436 if (errno == ERANGE && ulval == ULONG_MAX) 5437 return (-1); 5438 *ulvalp = ulval; 5439 return (0); 5440} 5441 5442int 5443getservice(char *n) 5444{ 5445 struct servent *s; 5446 u_long ulval; 5447 5448 if (atoul(n, &ulval) == 0) { 5449 if (ulval > 65535) { 5450 yyerror("illegal port value %lu", ulval); 5451 return (-1); 5452 } 5453 return (htons(ulval)); 5454 } else { 5455 s = getservbyname(n, "tcp"); 5456 if (s == NULL) 5457 s = getservbyname(n, "udp"); 5458 if (s == NULL) { 5459 yyerror("unknown port %s", n); 5460 return (-1); 5461 } 5462 return (s->s_port); 5463 } 5464} 5465 5466int 5467rule_label(struct pf_rule *r, char *s) 5468{ 5469 if (s) { 5470 if (strlcpy(r->label, s, sizeof(r->label)) >= 5471 sizeof(r->label)) { 5472 yyerror("rule label too long (max %d chars)", 5473 sizeof(r->label)-1); 5474 return (-1); 5475 } 5476 } 5477 return (0); 5478} 5479 5480u_int16_t 5481parseicmpspec(char *w, sa_family_t af) 5482{ 5483 const struct icmpcodeent *p; 5484 u_long ulval; 5485 u_int8_t icmptype; 5486 5487 if (af == AF_INET) 5488 icmptype = returnicmpdefault >> 8; 5489 else 5490 icmptype = returnicmp6default >> 8; 5491 5492 if (atoul(w, &ulval) == -1) { 5493 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5494 yyerror("unknown icmp code %s", w); 5495 return (0); 5496 } 5497 ulval = p->code; 5498 } 5499 if (ulval > 255) { 5500 yyerror("invalid icmp code %lu", ulval); 5501 return (0); 5502 } 5503 return (icmptype << 8 | ulval); 5504} 5505 5506int 5507pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5508{ 5509 struct loadanchors *la; 5510 FILE *fin; 5511 5512 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5513 if (pf->opts & PF_OPT_VERBOSE) 5514 fprintf(stderr, "\nLoading anchor %s from %s\n", 5515 la->anchorname, la->filename); 5516 if ((fin = pfctl_fopen(la->filename, "r")) == NULL) { 5517 warn("%s", la->filename); 5518 continue; 5519 } 5520 if (pfctl_rules(dev, la->filename, fin, pf->opts, pf->optimize, 5521 la->anchorname, trans) == -1) 5522 return (-1); 5523 } 5524 5525 return (0); 5526} 5527